Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ao8sixO8Om.exe

Overview

General Information

Sample name:Ao8sixO8Om.exe
renamed because original name is a hash value
Original sample name:4fdabc8b0698a97a412d5031522ad4bb0ff64f3807c0b4c0e15637ae9802bd44.exe
Analysis ID:1577186
MD5:cc0ee5bf6e42828ac49c73d1d112f338
SHA1:32807b59906bf5d8a1879a304323c3549c3d99c9
SHA256:4fdabc8b0698a97a412d5031522ad4bb0ff64f3807c0b4c0e15637ae9802bd44
Tags:130-193-51-109exeuser-JAMESWT_MHT
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found pyInstaller with non standard icon
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Ao8sixO8Om.exe (PID: 4676 cmdline: "C:\Users\user\Desktop\Ao8sixO8Om.exe" MD5: CC0EE5BF6E42828AC49C73D1D112F338)
    • Ao8sixO8Om.exe (PID: 6960 cmdline: "C:\Users\user\Desktop\Ao8sixO8Om.exe" MD5: CC0EE5BF6E42828AC49C73D1D112F338)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: Ao8sixO8Om.exeVirustotal: Detection: 22%Perma Link
Source: Ao8sixO8Om.exeReversingLabs: Detection: 13%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB785360 BCryptGenRandom,SystemFunction036,PyBytes_FromStringAndSize,PyBytes_AsString,memset,memcpy,memcpy,HeapFree,HeapFree,2_2_00007FFBAB785360
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB4018E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,2_2_00007FFBBB4018E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB406244 CRYPTO_memcmp,2_2_00007FFBBB406244
Source: Ao8sixO8Om.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAB61000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: cryptography_rust.pdbc source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: bcrypt_rust.pdbB source: Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1453550376.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1569127736.00007FFBC3523000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAAC9000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Ao8sixO8Om.exe, 00000000.00000003.1453550376.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1569127736.00007FFBC3523000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAB61000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1568363245.00007FFBBC703000.00000002.00000001.01000000.0000000A.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1568859851.00007FFBC3461000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567915558.00007FFBBB407000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567692183.00007FFBB4C4D000.00000002.00000001.01000000.00000011.sdmp, _bz2.pyd.0.dr
Source: Binary string: bcrypt_rust.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmp, _socket.pyd.0.dr
Source: Binary string: cryptography_rust.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552088727.0000027331EB0000.00000002.00000001.01000000.00000006.sdmp, python3.dll.0.dr
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE492F0 FindFirstFileExW,FindClose,0_2_00007FF61DE492F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF61DE483B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE618E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE492F0 FindFirstFileExW,FindClose,2_2_00007FF61DE492F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE618E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF61DE483B0
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: unknownTCP traffic detected without corresponding DNS query: 130.193.51.109
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB426260 recv,2_2_00007FFBBB426260
Source: Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _lzma.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1463413662.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1462143655.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1460696678.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: Ao8sixO8Om.exe, 00000002.00000003.1549148396.00000273321DA000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549148396.00000273321CE000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552644664.00000273321DE000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546616094.00000273321DA000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548705382.00000273321C9000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548354634.00000273321C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc4462.txt
Source: Ao8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.unix.com/man-page/all/3/krb5_kuserok/
Source: Ao8sixO8Om.exe, Ao8sixO8Om.exe, 00000002.00000002.1567171367.00007FFBAB7ED000.00000002.00000001.01000000.0000000E.sdmp, _cffi_backend.cp312-win_amd64.pyd.0.drString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: METADATA.0.drString found in binary or memory: https://cryptography.io
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: _rust.pyd.0.drString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/security/
Source: Ao8sixO8Om.exe, 00000002.00000003.1544665749.0000027332916000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549180494.000002733291B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548278468.000002733291A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: Ao8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: Ao8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: Ao8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ed25519.cr.yp.to/
Source: Ao8sixO8Om.exe, 00000002.00000003.1544312035.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555160578.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546079488.00000273329F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fabfile.org
Source: Ao8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Ao8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545760369.000002733221B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548448138.0000027332221000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548181893.000002733221C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480093562.0000027332921000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545231100.00000273321E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys
Source: Ao8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480093562.0000027332921000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
Source: Ao8sixO8Om.exe, 00000002.00000003.1544875442.00000273329B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544312035.0000027332945000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/paramiko/paramiko/pull/562
Source: Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/bcrypt/
Source: Ao8sixO8Om.exe, Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.drString found in binary or memory: https://github.com/pyca/bcrypt/__version_ex__4.2.1The
Source: Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/bcrypt/p3
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr, _rust.pyd.0.drString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: _rust.pyd.0.drString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: _rust.pyd.0.drString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/pynacl/
Source: Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Ao8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Ao8sixO8Om.exe, 00000002.00000003.1476174838.0000027332371000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549510656.000002733236D000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1476026693.0000027332446000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552895013.0000027332371000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1477430370.00000273324B6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1478420381.000002733236C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475972967.00000273324B6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549237893.000002733234A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: Ao8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: METADATA.0.drString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: METADATA.0.drString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: Ao8sixO8Om.exe, 00000002.00000003.1544312035.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544312035.0000027332945000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545303231.0000027332953000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546079488.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546534910.00000273329FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546559036.0000027332954000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://my.git.repository/
Source: Ao8sixO8Om.exe, 00000002.00000003.1477540541.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475235818.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475473788.0000027332415000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1476174838.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475178906.000002733241C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
Source: Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
Source: METADATA.0.drString found in binary or memory: https://pypi.org/project/cryptography/
Source: METADATA.0.drString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: Ao8sixO8Om.exe, 00000002.00000002.1555453821.0000027332D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc4462.html#section-2
Source: Ao8sixO8Om.exe, 00000002.00000003.1548900374.0000027332513000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544760631.00000273324FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1550105082.0000027332514000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546467496.00000273324FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1553859567.0000027332514000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc4462.html#section-2.2
Source: Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555453821.0000027332D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc4462.html#section-5
Source: Ao8sixO8Om.exe, 00000000.00000003.1456804172.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/
Source: Ao8sixO8Om.exe, 00000000.00000003.1456733799.000001BC346C1000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1456804172.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1456866759.000001BC346C1000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: Ao8sixO8Om.exe, 00000002.00000002.1559413049.00007FFBAAC0A000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.drString found in binary or memory: https://www.openssl.org/H
Source: Ao8sixO8Om.exe, 00000002.00000003.1474117151.000002733233B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331EF0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: Ao8sixO8Om.exe, 00000002.00000002.1564130997.00007FFBAB19C000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
Source: Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
Source: Ao8sixO8Om.exe, 00000002.00000002.1555704559.00000273331C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc4252#section-5.2
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AE9B0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,2_2_00007FFBAB7AE9B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE410000_2_00007FF61DE41000
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE669D40_2_00007FF61DE669D4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE65C700_2_00007FF61DE65C70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE48BD00_2_00007FF61DE48BD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE59F100_2_00007FF61DE59F10
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE65EEC0_2_00007FF61DE65EEC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE536100_2_00007FF61DE53610
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE5E5E00_2_00007FF61DE5E5E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE51DC40_2_00007FF61DE51DC4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE55DA00_2_00007FF61DE55DA0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE6411C0_2_00007FF61DE6411C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE618E40_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE498700_2_00007FF61DE49870
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE588040_2_00007FF61DE58804
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE51FD00_2_00007FF61DE51FD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE517B00_2_00007FF61DE517B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE697980_2_00007FF61DE69798
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE5DF600_2_00007FF61DE5DF60
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE5DACC0_2_00007FF61DE5DACC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE53A140_2_00007FF61DE53A14
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE521D40_2_00007FF61DE521D4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE519B40_2_00007FF61DE519B4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE581540_2_00007FF61DE58154
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE609380_2_00007FF61DE60938
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4AD1D0_2_00007FF61DE4AD1D
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4A4E40_2_00007FF61DE4A4E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE664880_2_00007FF61DE66488
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE609380_2_00007FF61DE60938
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE52C800_2_00007FF61DE52C80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE63C800_2_00007FF61DE63C80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE51BC00_2_00007FF61DE51BC0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4A34B0_2_00007FF61DE4A34B
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE410002_2_00007FF61DE41000
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE669D42_2_00007FF61DE669D4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE59F102_2_00007FF61DE59F10
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE65EEC2_2_00007FF61DE65EEC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE536102_2_00007FF61DE53610
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE5E5E02_2_00007FF61DE5E5E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE51DC42_2_00007FF61DE51DC4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE55DA02_2_00007FF61DE55DA0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE6411C2_2_00007FF61DE6411C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE618E42_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE498702_2_00007FF61DE49870
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE588042_2_00007FF61DE58804
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE51FD02_2_00007FF61DE51FD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE517B02_2_00007FF61DE517B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE697982_2_00007FF61DE69798
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE5DF602_2_00007FF61DE5DF60
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE5DACC2_2_00007FF61DE5DACC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE53A142_2_00007FF61DE53A14
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE521D42_2_00007FF61DE521D4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE519B42_2_00007FF61DE519B4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE581542_2_00007FF61DE58154
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE609382_2_00007FF61DE60938
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4AD1D2_2_00007FF61DE4AD1D
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4A4E42_2_00007FF61DE4A4E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE664882_2_00007FF61DE66488
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE609382_2_00007FF61DE60938
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE52C802_2_00007FF61DE52C80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE63C802_2_00007FF61DE63C80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE65C702_2_00007FF61DE65C70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE48BD02_2_00007FF61DE48BD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE51BC02_2_00007FF61DE51BC0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4A34B2_2_00007FF61DE4A34B
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB6012F02_2_00007FFBAB6012F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB6018A02_2_00007FFBAB6018A0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7324302_2_00007FFBAB732430
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB728C402_2_00007FFBAB728C40
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7403A52_2_00007FFBAB7403A5
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7253C02_2_00007FFBAB7253C0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB745FC02_2_00007FFBAB745FC0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7403F02_2_00007FFBAB7403F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB722F302_2_00007FFBAB722F30
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB740EB02_2_00007FFBAB740EB0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7452D02_2_00007FFBAB7452D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB72D6D02_2_00007FFBAB72D6D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7482E02_2_00007FFBAB7482E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB748AF02_2_00007FFBAB748AF0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7497102_2_00007FFBAB749710
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7232302_2_00007FFBAB723230
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB737E302_2_00007FFBAB737E30
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB734A702_2_00007FFBAB734A70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB74D2902_2_00007FFBAB74D290
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB741E902_2_00007FFBAB741E90
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7415D02_2_00007FFBAB7415D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7441D02_2_00007FFBAB7441D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7412002_2_00007FFBAB741200
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7381302_2_00007FFBAB738130
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB728D4F2_2_00007FFBAB728D4F
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB74D5702_2_00007FFBAB74D570
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB749D702_2_00007FFBAB749D70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7345802_2_00007FFBAB734580
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB72E8A02_2_00007FFBAB72E8A0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7418B02_2_00007FFBAB7418B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB72DCC02_2_00007FFBAB72DCC0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7254CF2_2_00007FFBAB7254CF
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB72C4E02_2_00007FFBAB72C4E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB729CF02_2_00007FFBAB729CF0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78BC402_2_00007FFBAB78BC40
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7A5BC02_2_00007FFBAB7A5BC0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB786C002_2_00007FFBAB786C00
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7944002_2_00007FFBAB794400
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7B3B202_2_00007FFBAB7B3B20
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78E3502_2_00007FFBAB78E350
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7853602_2_00007FFBAB785360
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78FAA02_2_00007FFBAB78FAA0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AA2D02_2_00007FFBAB7AA2D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78B3002_2_00007FFBAB78B300
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB79BA402_2_00007FFBAB79BA40
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB79AA602_2_00007FFBAB79AA60
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7899F02_2_00007FFBAB7899F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78F2002_2_00007FFBAB78F200
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7A69802_2_00007FFBAB7A6980
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7828202_2_00007FFBAB782820
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7A804E2_2_00007FFBAB7A804E
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AF0502_2_00007FFBAB7AF050
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AF8602_2_00007FFBAB7AF860
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AC8702_2_00007FFBAB7AC870
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7818902_2_00007FFBAB781890
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB79A0902_2_00007FFBAB79A090
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7A97B02_2_00007FFBAB7A97B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78A7702_2_00007FFBAB78A770
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78BF802_2_00007FFBAB78BF80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AA7802_2_00007FFBAB7AA780
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7847902_2_00007FFBAB784790
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78B6F02_2_00007FFBAB78B6F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB79FE102_2_00007FFBAB79FE10
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB78DD502_2_00007FFBAB78DD50
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB799D602_2_00007FFBAB799D60
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7A7D002_2_00007FFBAB7A7D00
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7DB4502_2_00007FFBAB7DB450
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1886E502_2_00007FFBB1886E50
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB18825202_2_00007FFBB1882520
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1888CD02_2_00007FFBB1888CD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB188F8BC2_2_00007FFBB188F8BC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1885C902_2_00007FFBB1885C90
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1881BA02_2_00007FFBB1881BA0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1882FD02_2_00007FFBB1882FD0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB18853602_2_00007FFBB1885360
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB18812B02_2_00007FFBB18812B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C43C802_2_00007FFBB4C43C80
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C43F102_2_00007FFBB4C43F10
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C42F002_2_00007FFBB4C42F00
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C461002_2_00007FFBB4C46100
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C410002_2_00007FFBB4C41000
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C4C8BC2_2_00007FFBB4C4C8BC
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB4018E02_2_00007FFBBB4018E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB4010002_2_00007FFBBB401000
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB4012B02_2_00007FFBBB4012B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB4212202_2_00007FFBBB421220
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: String function: 00007FFBAB78D1F0 appears 65 times
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: String function: 00007FF61DE42910 appears 34 times
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: String function: 00007FF61DE42710 appears 104 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1454418828.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1454173219.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1453550376.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exeBinary or memory string: OriginalFilename vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1568026449.00007FFBBB40E000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1552088727.0000027331EB0000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1565146648.00007FFBAB2C5000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1569197272.00007FFBC3529000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1568429490.00007FFBBC706000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1569008822.00007FFBC346E000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1559413049.00007FFBAAC0A000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1567792782.00007FFBB4C52000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Ao8sixO8Om.exe
Source: Ao8sixO8Om.exe, 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Ao8sixO8Om.exe
Source: classification engineClassification label: mal56.winEXE@3/26@0/1
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AE5D0 memset,GetModuleHandleW,FormatMessageW,GetLastError,HeapFree,2_2_00007FFBAB7AE5D0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762Jump to behavior
Source: Ao8sixO8Om.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Ao8sixO8Om.exeVirustotal: Detection: 22%
Source: Ao8sixO8Om.exeReversingLabs: Detection: 13%
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile read: C:\Users\user\Desktop\Ao8sixO8Om.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Ao8sixO8Om.exe "C:\Users\user\Desktop\Ao8sixO8Om.exe"
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeProcess created: C:\Users\user\Desktop\Ao8sixO8Om.exe "C:\Users\user\Desktop\Ao8sixO8Om.exe"
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeProcess created: C:\Users\user\Desktop\Ao8sixO8Om.exe "C:\Users\user\Desktop\Ao8sixO8Om.exe"Jump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeSection loaded: kernel.appcore.dllJump to behavior
Source: Ao8sixO8Om.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: Ao8sixO8Om.exeStatic file information: File size 11373110 > 1048576
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Ao8sixO8Om.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Ao8sixO8Om.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1466669781.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1572334144.000001BC346C0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAB61000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: cryptography_rust.pdbc source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: bcrypt_rust.pdbB source: Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1453550376.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1569127736.00007FFBC3523000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAAC9000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Ao8sixO8Om.exe, 00000000.00000003.1453550376.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1569127736.00007FFBC3523000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1558643243.00007FFBAAB61000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source: Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1465792285.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1568363245.00007FFBBC703000.00000002.00000001.01000000.0000000A.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1568859851.00007FFBC3461000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1454680272.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567915558.00007FFBBB407000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1454858937.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1453740195.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1567692183.00007FFBB4C4D000.00000002.00000001.01000000.00000011.sdmp, _bz2.pyd.0.dr
Source: Binary string: bcrypt_rust.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1455035722.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmp, _socket.pyd.0.dr
Source: Binary string: cryptography_rust.pdb source: Ao8sixO8Om.exe, 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmp, _rust.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: Ao8sixO8Om.exe, 00000000.00000003.1455458702.000001BC346B0000.00000004.00000020.00020000.00000000.sdmp, _wmi.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Ao8sixO8Om.exe, 00000000.00000003.1462654475.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552088727.0000027331EB0000.00000002.00000001.01000000.00000006.sdmp, python3.dll.0.dr
Source: Ao8sixO8Om.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Ao8sixO8Om.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Ao8sixO8Om.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Ao8sixO8Om.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Ao8sixO8Om.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AF840 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,HeapFree,ReleaseMutex,2_2_00007FFBAB7AF840
Source: python312.dll.0.drStatic PE information: section name: PyRuntim
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB188D3E8 push rbp; iretd 2_2_00007FFBB188D3ED

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeProcess created: "C:\Users\user\Desktop\Ao8sixO8Om.exe"
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\select.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl\_sodium.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt\_bcrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE476B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF61DE476B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\select.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl\_sodium.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt\_bcrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17383
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeAPI coverage: 2.0 %
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE492F0 FindFirstFileExW,FindClose,0_2_00007FF61DE492F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF61DE483B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE618E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE492F0 FindFirstFileExW,FindClose,2_2_00007FF61DE492F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE618E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF61DE618E4
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE483B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF61DE483B0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB723D10 GetSystemInfo,2_2_00007FFBAB723D10
Source: _rust.pyd.0.drBinary or memory string: vmCimC
Source: Ao8sixO8Om.exe, 00000002.00000003.1548461994.0000027332190000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1550331497.0000027332193000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1550571136.0000027332198000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1551353626.000002733219E000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1550372162.0000027332194000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWs
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE5A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF61DE5A684
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7AF840 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,HeapFree,ReleaseMutex,2_2_00007FFBAB7AF840
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE634F0 GetProcessHeap,0_2_00007FF61DE634F0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE5A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF61DE5A684
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF61DE4C910
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF61DE4D19C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4D37C SetUnhandledExceptionFilter,0_2_00007FF61DE4D37C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE5A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF61DE5A684
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF61DE4C910
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF61DE4D19C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FF61DE4D37C SetUnhandledExceptionFilter,2_2_00007FF61DE4D37C
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB602AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBAB602AA0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB603068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBAB603068
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB74E460 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBAB74E460
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB74DD70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBAB74DD70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7B0BE8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBAB7B0BE8
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7EB360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBAB7EB360
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBAB7EBCC8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBAB7EBCC8
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1893CE0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBB1893CE0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB1893710 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBB1893710
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C4AB08 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBB4C4AB08
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBB4C4A0C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBB4C4A0C0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB404660 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFBBB404660
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 2_2_00007FFBBB404090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFBBB404090
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeProcess created: C:\Users\user\Desktop\Ao8sixO8Om.exe "C:\Users\user\Desktop\Ao8sixO8Om.exe"Jump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE695E0 cpuid 0_2_00007FF61DE695E0
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\licenses VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\licenses VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings\_rust.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_cffi_backend.cp312-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt\_bcrypt.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\nacl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\Desktop\Ao8sixO8Om.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI46762\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE4D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF61DE4D080
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeCode function: 0_2_00007FF61DE65C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF61DE65C70
Source: C:\Users\user\Desktop\Ao8sixO8Om.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information		NTDS24
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Ao8sixO8Om.exe23%VirustotalBrowse
Ao8sixO8Om.exe13%ReversingLabsWin64.Malware.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_cffi_backend.cp312-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\_wmi.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt\_bcrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings\_rust.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\libcrypto-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\libffi-8.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\nacl\_sodium.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\python3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\python312.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46762\unicodedata.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://fabfile.org0%Avira URL Cloudsafe
https://ed25519.cr.yp.to/0%Avira URL Cloudsafe
https://my.git.repository/0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/pyca/cryptography/issues/8996_rust.pyd.0.drfalse
    		high
    https://github.com/pyca/bcrypt/__version_ex__4.2.1TheAo8sixO8Om.exe, Ao8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.drfalse
      		high
      https://github.com/paramiko/paramiko/pull/562Ao8sixO8Om.exe, 00000002.00000003.1544875442.00000273329B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544312035.0000027332945000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/pyca/cryptographyMETADATA.0.drfalse
          		high
          https://www.python.org/download/releases/2.3/mro/.Ao8sixO8Om.exe, 00000002.00000003.1474117151.000002733233B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331EF0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
            		high
            https://cryptography.io/METADATA.0.drfalse
              		high
              https://tools.ietf.org/html/rfc4462.html#section-2.2Ao8sixO8Om.exe, 00000002.00000003.1548900374.0000027332513000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544760631.00000273324FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1550105082.0000027332514000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546467496.00000273324FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1553859567.0000027332514000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourceAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://docs.rs/getrandom#nodejs-es-module-supportAo8sixO8Om.exe, 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmp, _bcrypt.pyd.0.drfalse
                    		high
                    https://github.com/pyca/cryptography/METADATA.0.drfalse
                      		high
                      https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeysAo8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545760369.000002733221B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548448138.0000027332221000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548181893.000002733221C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480093562.0000027332921000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545231100.00000273321E0000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#Ao8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/pyca/pynacl/Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_dataAo8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/pyca/bcrypt/p3Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/pyca/cryptography/actions?query=workflow%3ACIMETADATA.0.drfalse
                                    		high
                                    https://www.apache.org/licenses/LICENSE-2.0Ao8sixO8Om.exe, 00000000.00000003.1456733799.000001BC346C1000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1456804172.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000000.00000003.1456866759.000001BC346C1000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.drfalse
                                      		high
                                      https://fabfile.orgAo8sixO8Om.exe, 00000002.00000003.1544312035.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555160578.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546079488.00000273329F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64Ao8sixO8Om.exe, 00000002.00000003.1544665749.0000027332916000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549180494.000002733291B000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548278468.000002733291A000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://ed25519.cr.yp.to/Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.ietf.org/rfc/rfc4462.txtAo8sixO8Om.exe, 00000002.00000003.1549148396.00000273321DA000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549148396.00000273321CE000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552644664.00000273321DE000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546616094.00000273321DA000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548705382.00000273321C9000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548354634.00000273321C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://tools.ietf.org/html/rfc4462.html#section-2Ao8sixO8Om.exe, 00000002.00000002.1555453821.0000027332D70000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://tools.ietf.org/html/rfc4462.html#section-5Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555453821.0000027332D70000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://cryptography.io/en/latest/changelog/METADATA.0.drfalse
                                                		high
                                                https://github.com/pyca/cryptography/issues/9253_rust.pyd.0.drfalse
                                                  		high
                                                  https://github.com/pyca/bcrypt/Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://mail.python.org/mailman/listinfo/cryptography-devMETADATA.0.drfalse
                                                      		high
                                                      https://peps.python.org/pep-0205/Ao8sixO8Om.exe, 00000002.00000003.1477540541.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475235818.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475473788.0000027332415000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1476174838.0000027332414000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475178906.000002733241C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                                                        		high
                                                        https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenameAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688Ao8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codeAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.rfc-editor.org/rfc/rfc4252#section-5.2Ao8sixO8Om.exe, 00000002.00000002.1555704559.00000273331C8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerAo8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/python/cpython/issues/86361.Ao8sixO8Om.exe, 00000002.00000003.1476174838.0000027332371000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549510656.000002733236D000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1476026693.0000027332446000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1552895013.0000027332371000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1477430370.00000273324B6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1478420381.000002733236C000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1475972967.00000273324B6000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549237893.000002733234A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.apache.org/licenses/Ao8sixO8Om.exe, 00000000.00000003.1456804172.000001BC346B4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.drfalse
                                                                      		high
                                                                      https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.keyAo8sixO8Om.exe, 00000002.00000003.1480025569.0000027332911000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1555355619.0000027332C70000.00000004.00001000.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1480093562.0000027332921000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainMETADATA.0.drfalse
                                                                          		high
                                                                          https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file_rust.pyd.0.drfalse
                                                                            		high
                                                                            https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_moduleAo8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_packageAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesAo8sixO8Om.exe, 00000002.00000002.1552744466.0000027332230000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://cryptography.io/en/latest/installation/METADATA.0.drfalse
                                                                                    		high
                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_moduleAo8sixO8Om.exe, 00000002.00000002.1552199483.0000027331F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syAo8sixO8Om.exe, 00000002.00000003.1551061003.00000273305AF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549624646.00000273305A4000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1548674362.00000273305A2000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1549873877.00000273305AD000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://my.git.repository/Ao8sixO8Om.exe, 00000002.00000003.1544312035.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1544312035.0000027332945000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1545303231.0000027332953000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546079488.00000273329F0000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546534910.00000273329FF000.00000004.00000020.00020000.00000000.sdmp, Ao8sixO8Om.exe, 00000002.00000003.1546559036.0000027332954000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://www.python.org/psf/license/Ao8sixO8Om.exe, 00000002.00000002.1564130997.00007FFBAB19C000.00000008.00000001.01000000.00000004.sdmpfalse
                                                                                          		high
                                                                                          https://img.shields.io/pypi/v/cryptography.svgMETADATA.0.drfalse
                                                                                            		high
                                                                                            https://cryptography.io/en/latest/security/METADATA.0.drfalse
                                                                                              		high
                                                                                              https://cffi.readthedocs.io/en/latest/using.html#callbacksAo8sixO8Om.exe, Ao8sixO8Om.exe, 00000002.00000002.1567171367.00007FFBAB7ED000.00000002.00000001.01000000.0000000E.sdmp, _cffi_backend.cp312-win_amd64.pyd.0.drfalse
                                                                                                		high
                                                                                                http://www.unix.com/man-page/all/3/krb5_kuserok/Ao8sixO8Om.exe, 00000002.00000003.1544706529.00000273321D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.openssl.org/HAo8sixO8Om.exe, 00000002.00000002.1559413049.00007FFBAAC0A000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.drfalse
                                                                                                    		high
                                                                                                    https://www.python.org/psf/license/)Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyAo8sixO8Om.exe, 00000002.00000002.1551974343.00000273305B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://cryptography.ioMETADATA.0.drfalse
                                                                                                          		high
                                                                                                          https://github.com/pyca/cryptography/issuesMETADATA.0.dr, _rust.pyd.0.drfalse
                                                                                                            		high
                                                                                                            https://readthedocs.org/projects/cryptography/badge/?version=latestMETADATA.0.drfalse
                                                                                                              		high
                                                                                                              https://peps.python.org/pep-0263/Ao8sixO8Om.exe, 00000002.00000002.1561560582.00007FFBAB024000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                                		high
                                                                                                                https://pypi.org/project/cryptography/METADATA.0.drfalse
                                                                                                                  		high

                                                                                                                  World Map of Contacted IPs

                                                                                                                  • No. of IPs < 25%
                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                  • 75% < No. of IPs

                                                                                                                  Public IPs

                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                  130.193.51.109
                                                                                                                  		unknownRussian Federation
                                                                                                                  		200350YANDEXCLOUDRUfalse

                                                                                                                  General Information

                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1577186
                                                                                                                  Start date and time:2024-12-18 08:49:14 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 7m 1s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:6
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:0
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:Ao8sixO8Om.exe
                                                                                                                  renamed because original name is a hash value
                                                                                                                  Original Sample Name:4fdabc8b0698a97a412d5031522ad4bb0ff64f3807c0b4c0e15637ae9802bd44.exe
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal56.winEXE@3/26@0/1
                                                                                                                  EGA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  HCA Information:Failed
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                  • Stop behavior analysis, all processes terminated

                                                                                                                  Warnings

                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.149.20.212
                                                                                                                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.

                                                                                                                  Simulations

                                                                                                                  Behavior and APIs

                                                                                                                  ⊘No simulations

                                                                                                                  Joe Sandbox View / Context

                                                                                                                  IPs

                                                                                                                  ⊘No context

                                                                                                                  Domains

                                                                                                                  ⊘No context

                                                                                                                  ASNs

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  YANDEXCLOUDRUSecuriteInfo.com.Win32.Trojan-Downloader.Generic.9UTDDY.27958.1932.exeGet hashmaliciousMetasploitBrowse
                                                                                                                  • 84.201.150.223
                                                                                                                  SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exeGet hashmaliciousMetasploitBrowse
                                                                                                                  • 84.201.150.223
                                                                                                                  http://xn--r1a.website/s/ogorodruGet hashmaliciousUnknownBrowse
                                                                                                                  • 130.193.42.23
                                                                                                                  http://vidaliaonion.orgGet hashmaliciousUnknownBrowse
                                                                                                                  • 130.193.53.230
                                                                                                                  Vt5wr1Hj3H.elfGet hashmaliciousMiraiBrowse
                                                                                                                  • 178.154.229.200
                                                                                                                  https://faq-kak.ru/kak-najti-svoyu-biblioteku-v-steam/Get hashmaliciousUnknownBrowse
                                                                                                                  • 130.193.58.13
                                                                                                                  loligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                  • 84.201.130.205
                                                                                                                  http://paypal.6887xyyz.biz.id/Get hashmaliciousUnknownBrowse
                                                                                                                  • 130.193.53.144
                                                                                                                  file.exeGet hashmaliciousRaccoon Stealer v2, RedLine, SmokeLoaderBrowse
                                                                                                                  • 130.193.51.105
                                                                                                                  file.exeGet hashmaliciousDarkTortilla, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoaderBrowse
                                                                                                                  • 130.193.51.105

                                                                                                                  JA3 Fingerprints

                                                                                                                  ⊘No context

                                                                                                                  Dropped Files

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dllfWAr4zGUkY.exeGet hashmaliciousRemcos, Amadey, StealcBrowse
                                                                                                                    fbc5UlsRXq.exeGet hashmaliciousUnknownBrowse
                                                                                                                      5SkF9LFhB3.exeGet hashmaliciousUnknownBrowse
                                                                                                                        WUD0WG3OdV.exeGet hashmaliciousUnknownBrowse
                                                                                                                          98Y05R2rTb.exeGet hashmaliciousUnknownBrowse
                                                                                                                            aLsxeH29P2.exeGet hashmaliciousUnknownBrowse
                                                                                                                              c9a6BV0eQO.exeGet hashmaliciousUnknownBrowse
                                                                                                                                https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exeGet hashmaliciousUnknownBrowse
                                                                                                                                  0jNz7djbpp.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                    7EznMik8Fw.exeGet hashmaliciousPython StealerBrowse

                                                                                                                                      Created / dropped Files

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):119192
                                                                                                                                      Entropy (8bit):6.6016214745004635
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                                                                                                                      MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                                                                                                                      SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                                                                                                                      SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                                                                                                                      SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Joe Sandbox View:
                                                                                                                                      • Filename: fWAr4zGUkY.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: fbc5UlsRXq.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: 5SkF9LFhB3.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: WUD0WG3OdV.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: 98Y05R2rTb.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: aLsxeH29P2.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: c9a6BV0eQO.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                      • Filename: 0jNz7djbpp.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: 7EznMik8Fw.exe, Detection: malicious, Browse
                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_bz2.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):84760
                                                                                                                                      Entropy (8bit):6.5874715807724025
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
                                                                                                                                      MD5:59D60A559C23202BEB622021AF29E8A9
                                                                                                                                      SHA1:A405F23916833F1B882F37BDBBA2DD799F93EA32
                                                                                                                                      SHA-256:706D4A0C26DD454538926CBB2FF6C64257C3D9BD48C956F7CABD6DEF36FFD13E
                                                                                                                                      SHA-512:2F60E79603CF456B2A14B8254CEC75CE8BE0A28D55A874D4FB23D92D63BBE781ED823AB0F4D13A23DC60C4DF505CBF1DBE1A0A2049B02E4BDEC8D374898002B1
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d......e.........." ...%.....^......|........................................P......-B....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):182784
                                                                                                                                      Entropy (8bit):6.193615170968096
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
                                                                                                                                      MD5:0572B13646141D0B1A5718E35549577C
                                                                                                                                      SHA1:EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
                                                                                                                                      SHA-256:D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
                                                                                                                                      SHA-512:67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_ctypes.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):125208
                                                                                                                                      Entropy (8bit):6.128664719423826
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
                                                                                                                                      MD5:2A834C3738742D45C0A06D40221CC588
                                                                                                                                      SHA1:606705A593631D6767467FB38F9300D7CD04AB3E
                                                                                                                                      SHA-256:F20DFA748B878751EA1C4FE77A230D65212720652B99C4E5577BCE461BBD9089
                                                                                                                                      SHA-512:924235A506CE4D635FA7C2B34E5D8E77EFF73F963E58E29C6EF89DB157BF7BAB587678BB2120D09DA70594926D82D87DBAA5D247E861E331CF591D45EA19A117
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d......e.........." ...%............p_..............................................]R....`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_decimal.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):252696
                                                                                                                                      Entropy (8bit):6.564448148079112
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
                                                                                                                                      MD5:F930B7550574446A015BC602D59B0948
                                                                                                                                      SHA1:4EE6FF8019C6C540525BDD2790FC76385CDD6186
                                                                                                                                      SHA-256:3B9AD1D2BC9EC03D37DA86135853DAC73B3FE851B164FE52265564A81EB8C544
                                                                                                                                      SHA-512:10B864975945D6504433554F9FF11B47218CAA00F809C6BCE00F9E4089B862190A4219F659697A4BA5E5C21EDBE1D8D325950921E09371ACC4410469BD9189EE
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d......e.........." ...%.t...<......................................................6.....`.........................................@T..P....T..................0'......./......P...@...T...............................@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data....*...p...$...P..............@....pdata..0'.......(...t..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_hashlib.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):65816
                                                                                                                                      Entropy (8bit):6.242741772115205
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
                                                                                                                                      MD5:B0262BD89A59A3699BFA75C4DCC3EE06
                                                                                                                                      SHA1:EB658849C646A26572DEA7F6BFC042CB62FB49DC
                                                                                                                                      SHA-256:4ADFBBD6366D9B55D902FC54D2B42E7C8C989A83016ED707BD7A302FC3FC7B67
                                                                                                                                      SHA-512:2E4B214DE3B306E3A16124AF434FF8F5AB832AA3EEB1AA0AA9B49B0ADA0928DCBB05C57909292FBE3B01126F4CD3FE0DAC9CC15EAEA5F3844D6E267865B9F7B1
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.}&...&..'...&..'...&..'...&..'...&...'...&.x.'...&...&}..&.x.'...&.x.'...&.x.&...&.x.'...&Rich...&........................PE..d.....e.........." ...%.T..........P@....................................................`.............................................P.............................../......X...@}..T............................|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_lzma.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159512
                                                                                                                                      Entropy (8bit):6.846323229710623
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
                                                                                                                                      MD5:B71DBE0F137FFBDA6C3A89D5BCBF1017
                                                                                                                                      SHA1:A2E2BDC40FDB83CC625C5B5E8A336CA3F0C29C5F
                                                                                                                                      SHA-256:6216173194B29875E84963CD4DC4752F7CA9493F5B1FD7E4130CA0E411C8AC6A
                                                                                                                                      SHA-512:9A5C7B1E25D8E1B5738F01AEDFD468C1837F1AC8DD4A5B1D24CE86DCAE0DB1C5B20F2FF4280960BC523AEE70B71DB54FD515047CDAF10D21A8BEC3EBD6663358
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d.....e.........." ...%.d...........6....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...............................@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_socket.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):83224
                                                                                                                                      Entropy (8bit):6.338326324626716
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
                                                                                                                                      MD5:9C6283CC17F9D86106B706EC4EA77356
                                                                                                                                      SHA1:AF4F2F52CE6122F340E5EA1F021F98B1FFD6D5B6
                                                                                                                                      SHA-256:5CC62AAC52EDF87916DEB4EBBAD9ABB58A6A3565B32E7544F672ACA305C38027
                                                                                                                                      SHA-512:11FD6F570DD78F8FF00BE645E47472A96DAFFA3253E8BD29183BCCDE3F0746F7E436A106E9A68C57CC05B80A112365441D06CC719D51C906703B428A32C93124
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|../8z.|8z.|8z.|1.T|>z.|-..}:z.|-..}5z.|-..}0z.|-..};z.|...}:z.|8z.|.z.|s..}1z.|...}9z.|...}9z.|..8|9z.|...}9z.|Rich8z.|........PE..d......e.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\_wmi.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):36632
                                                                                                                                      Entropy (8bit):6.357254511176439
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:6cxnHG7MYGQd0hHdzA77yeu1IACis5YiSyvoAMxkE9:6cxnm7M6dAHdzA77yeu1IACiW7Sy+xx
                                                                                                                                      MD5:C1654EBEBFEEDA425EADE8B77CA96DE5
                                                                                                                                      SHA1:A4A150F1C810077B6E762F689C657227CC4FD257
                                                                                                                                      SHA-256:AA1443A715FBF84A84F39BD89707271FC11A77B597D7324CE86FC5CFA56A63A9
                                                                                                                                      SHA-512:21705B991E75EFD5E59B8431A3B19AE5FCC38A3E7F137A9D52ACD24E7F67D61758E48ABC1C9C0D4314FA02010A1886C15EAD5BCA8DCA1B1D4CCBFC3C589D342E
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d......e.........." ...%.(...:.......&..............................................!n....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\base_library.zip

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):1332263
                                                                                                                                      Entropy (8bit):5.5864610174712706
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjtgkV+dmmPHHz1dF6sF7aYcea:uttcY+UHCiCAd+mq+dmmPnz4waYcea
                                                                                                                                      MD5:0CD72BCBFCA52707A1FD52F6038B6020
                                                                                                                                      SHA1:BBEA1763F250143804905F719D88ED2710C23DB3
                                                                                                                                      SHA-256:66FD3CE5401FEAC826504CEB1BBF3AF3E8B41702BBA03A6C91289DF59228C368
                                                                                                                                      SHA-512:4FB8F17EA900B243BCD1042E5300238E7D1B03FA2B74E3F4FFABA9B6A181BF6F81A6903B816BA524B9AFB78586A9C6167ACC4071CF009ED5FF4EF295B06FB96B
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\bcrypt\_bcrypt.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):308224
                                                                                                                                      Entropy (8bit):6.443610691560751
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:h209IAef4RFcFeRymle2OMnW4fkxjbe2whOFe36QttLGk8nX8LbTAdkXZzLnR/Xa:ht9EG+F8jnW4fkx/eFhOFfxsL/ZXR/X
                                                                                                                                      MD5:224F751B66DF946EE42F7178906E1A09
                                                                                                                                      SHA1:69AFF2D45AB50EA5C6863CA5E295E4042747D6B0
                                                                                                                                      SHA-256:F4813262B14EED22344F528D6321756578E2B9A825332A79CD2D057179CD2E0E
                                                                                                                                      SHA-512:1CAACF08C8C42CCC1F817C59297EB181372585A7158B441965C3EE9C0EDE42E2D8B9FC56AD19BA8106DC33A2FB7F10BB4F0FD6E5E892E026E252706C5522016E
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.Y.............s9.........................................................y...........p.......p.......Rich............................PE..d...v.<g.........." ...*.:...x......\.....................................................`.............................................T.......................$..................@...T.......................(.......@............P..X............................text....9.......:.................. ..`.rdata...E...P...F...>..............@..@.data...0...........................@....pdata...$.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\INSTALLER

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):4
                                                                                                                                      Entropy (8bit):1.5
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:Mn:M
                                                                                                                                      MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                      SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                      SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                      SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:pip.

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\METADATA

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):5724
                                                                                                                                      Entropy (8bit):5.120429897887076
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
                                                                                                                                      MD5:526D9AC9D8150602EC9ED8B9F4DE7102
                                                                                                                                      SHA1:DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
                                                                                                                                      SHA-256:D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
                                                                                                                                      SHA-512:FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\RECORD

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:CSV text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):16380
                                                                                                                                      Entropy (8bit):5.587009861664839
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:hXr12s/l45jEVeK+VqhXJZ4WJJ6sf7B0PpzIq+NX6ih5VFUqq8q:hXplMEVdhJrJJ6sf7B0Ppz/+96ihu8q
                                                                                                                                      MD5:A53742D3EE69CAE1FD8BDEDAC05BB828
                                                                                                                                      SHA1:02BC360839FEB54E58E14D410266652DCB718353
                                                                                                                                      SHA-256:9518E7D9DA0F889F568F800E1A4ADC0686234DC9D9934A46F78FFB5E6C351A98
                                                                                                                                      SHA-512:C69C4D3ECA56D725E90F9F0C4B98071F4F92A3BC06A635CE0D6309976C750B20B3DA353EFED27F07712FF5E0C1A8114300004C8E2D2EE9155F31D856A3C6EE05
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\WHEEL

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):94
                                                                                                                                      Entropy (8bit):5.0373614967294325
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
                                                                                                                                      MD5:A868F93FCF51C4F1C25658D54F994349
                                                                                                                                      SHA1:535C88A10911673DEABB7889D365E81729E483A6
                                                                                                                                      SHA-256:1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
                                                                                                                                      SHA-512:EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\licenses\LICENSE

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):197
                                                                                                                                      Entropy (8bit):4.61968998873571
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                      MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                      SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                      SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                      SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):11360
                                                                                                                                      Entropy (8bit):4.426756947907149
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                      MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                      SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                      SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                      SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:ASCII text
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):1532
                                                                                                                                      Entropy (8bit):5.058591167088024
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                      MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                      SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                      SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                      SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):8292864
                                                                                                                                      Entropy (8bit):6.493076254122072
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
                                                                                                                                      MD5:34293B976DA366D83C12D8EE05DE7B03
                                                                                                                                      SHA1:82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
                                                                                                                                      SHA-256:A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
                                                                                                                                      SHA-512:0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\libcrypto-3.dll

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):5191960
                                                                                                                                      Entropy (8bit):5.962142634441191
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
                                                                                                                                      MD5:E547CF6D296A88F5B1C352C116DF7C0C
                                                                                                                                      SHA1:CAFA14E0367F7C13AD140FD556F10F320A039783
                                                                                                                                      SHA-256:05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
                                                                                                                                      SHA-512:9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\libffi-8.dll

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):39696
                                                                                                                                      Entropy (8bit):6.641880464695502
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                      MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                      SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                      SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                      SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\nacl\_sodium.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):348672
                                                                                                                                      Entropy (8bit):6.620074456825018
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6144:PS8ZHilzJNijWKvNpwNasFp2HX5l5XBMC+ZSHUV50DErV4c+:PSEilzJNijfpOSjDz
                                                                                                                                      MD5:9D1B8BAD0E17E63B9D8E441CDC15BAEE
                                                                                                                                      SHA1:0C5A62135B072D1951A9D6806B9EFF7AA9C897A3
                                                                                                                                      SHA-256:D733C23C6A4B21625A4FF07F6562BA882BCBDB0F50826269419D8DE0574F88CD
                                                                                                                                      SHA-512:49E7F6AB825D5047421641ED4618FF6CB2A8D22A8A4AE1BD8F2DEEFE7987D80C8E0ACC72B950D02214F7B41DC4A42DF73A7F5742EBC96670D1C5A28C47B97355
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................a.........................................................................r.............Rich............PE..d......a.........." .........@......P.....................................................`.............................................P............p.......P..(...............|...@...............................`...8............0...............................text...H........................... ..`.rdata.......0......................@..@.data....8.......2..................@....pdata..(....P.......,..............@..@.rsrc........p.......J..............@..@.reloc..|............L..............@..B........................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\python3.dll

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):68376
                                                                                                                                      Entropy (8bit):6.14896460878624
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
                                                                                                                                      MD5:6271A2FE61978CA93E60588B6B63DEB2
                                                                                                                                      SHA1:BE26455750789083865FE91E2B7A1BA1B457EFB8
                                                                                                                                      SHA-256:A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB
                                                                                                                                      SHA-512:8C32BCB500A94FF47F5EF476AE65D3B677938EBEE26E80350F28604AAEE20B044A5D55442E94A11CCD9962F34D22610B932AC9D328197CF4D2FFBC7DF640EFBA
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%............................................................x.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\python312.dll

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):7009048
                                                                                                                                      Entropy (8bit):5.7826778751744685
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
                                                                                                                                      MD5:550288A078DFFC3430C08DA888E70810
                                                                                                                                      SHA1:01B1D31F37FB3FD81D893CC5E4A258E976F5884F
                                                                                                                                      SHA-256:789A42AC160CEF98F8925CB347473EEEB4E70F5513242E7FABA5139BA06EDF2D
                                                                                                                                      SHA-512:7244432FC3716F7EF27630D4E8FBC8180A2542AA97A01D44DCA260AB43966DD8AC98B6023400B0478A4809AACE1A128F1F4D6E544F2E591A5B436FD4C8A9D723
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..e...e...e...d...e.......e...`...e...a...e...f...e.......e..d...e...d...e..Bh.M.e..Be...e..B....e..Bg...e.Rich..e.........................PE..d......e.........." ...%.$)..ZB......]........................................k.....:.k...`...........................................O.d...toP......Pj.......`.dZ....j../...`j.pZ....3.T.....................I.(...P.3.@............@)..............................text....")......$)................. ..`.rdata...T'..@)..V'..().............@..@.data....?....P......~P.............@....pdata..dZ....`..\....`.............@..@PyRuntim.....@c......\b.............@....rsrc........Pj......^i.............@..@.reloc..pZ...`j..\...hi.............@..B........................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\select.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):30488
                                                                                                                                      Entropy (8bit):6.582548725691534
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
                                                                                                                                      MD5:8A273F518973801F3C63D92AD726EC03
                                                                                                                                      SHA1:069FC26B9BD0F6EA3F9B3821AD7C812FD94B021F
                                                                                                                                      SHA-256:AF358285A7450DE6E2E5E7FF074F964D6A257FB41D9EB750146E03C7DDA503CA
                                                                                                                                      SHA-512:7FEDAE0573ECB3946EDE7D0B809A98ACAD3D4C95D6C531A40E51A31BDB035BADC9F416D8AAA26463784FF2C5E7A0CC2C793D62B5FDB2B8E9FAD357F93D3A65F8
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d......e.........." ...%.....2.......................................................y....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI46762\unicodedata.pyd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):1137944
                                                                                                                                      Entropy (8bit):5.462202215180296
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12288:hrEHdcM6hbFCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciFt:hrEXYCjfk7bPNfv42BN6yzUiFt
                                                                                                                                      MD5:04F35D7EEC1F6B72BAB9DAF330FD0D6B
                                                                                                                                      SHA1:ECF0C25BA7ADF7624109E2720F2B5930CD2DBA65
                                                                                                                                      SHA-256:BE942308D99CC954931FE6F48ED8CC7A57891CCBE99AAE728121BCDA1FD929AB
                                                                                                                                      SHA-512:3DA405E4C1371F4B265E744229DCC149491A112A2B7EA8E518D5945F8C259CAD15583F25592B35EC8A344E43007AE00DA9673822635EE734D32664F65C9C8D9B
                                                                                                                                      Malicious:false
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d......e.........." ...%.>..........`*.......................................p............`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

                                                                                                                                      Static File Info

                                                                                                                                      General

                                                                                                                                      File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                      Entropy (8bit):7.990538391491392
                                                                                                                                      TrID:
                                                                                                                                      • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                      • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                      File name:Ao8sixO8Om.exe
                                                                                                                                      File size:11'373'110 bytes
                                                                                                                                      MD5:cc0ee5bf6e42828ac49c73d1d112f338
                                                                                                                                      SHA1:32807b59906bf5d8a1879a304323c3549c3d99c9
                                                                                                                                      SHA256:4fdabc8b0698a97a412d5031522ad4bb0ff64f3807c0b4c0e15637ae9802bd44
                                                                                                                                      SHA512:fee5a38e217273aa31c49440737832fb3d6bd94960b1014d3936bb2883675587f5634d2ec358151a4148e7b30253cfe0c0b44bd518060cb255846c6e3c5ba5da
                                                                                                                                      SSDEEP:196608:SdKUHapwq3OQos23SlwA1HeT39IigQvKub75bcjWgbkzfKAkjaW8Oh4:AVapwq3Obs2ClJ1+TtIifvB5IjWqkzAn
                                                                                                                                      TLSH:84B6335477B32CFBCAB653389AA28416FF626B4A2733CA8B47744182DF072934E75351
                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

                                                                                                                                      File Icon

                                                                                                                                      Icon Hash:391d8c069399743a

                                                                                                                                      Static PE Info

                                                                                                                                      General

                                                                                                                                      Entrypoint:0x14000ce20
                                                                                                                                      Entrypoint Section:.text
                                                                                                                                      Digitally signed:false
                                                                                                                                      Imagebase:0x140000000
                                                                                                                                      Subsystem:windows gui
                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                      Time Stamp:0x675C2784 [Fri Dec 13 12:24:36 2024 UTC]
                                                                                                                                      TLS Callbacks:
                                                                                                                                      CLR (.Net) Version:
                                                                                                                                      OS Version Major:6
                                                                                                                                      OS Version Minor:0
                                                                                                                                      File Version Major:6
                                                                                                                                      File Version Minor:0
                                                                                                                                      Subsystem Version Major:6
                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                      Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                      Entrypoint Preview

                                                                                                                                      Instruction
                                                                                                                                      dec eax
                                                                                                                                      sub esp, 28h
                                                                                                                                      call 00007F5FD8807D0Ch
                                                                                                                                      dec eax
                                                                                                                                      add esp, 28h
                                                                                                                                      jmp 00007F5FD880792Fh
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      dec eax
                                                                                                                                      sub esp, 28h
                                                                                                                                      call 00007F5FD88080D8h
                                                                                                                                      test eax, eax
                                                                                                                                      je 00007F5FD8807AD3h
                                                                                                                                      dec eax
                                                                                                                                      mov eax, dword ptr [00000030h]
                                                                                                                                      dec eax
                                                                                                                                      mov ecx, dword ptr [eax+08h]
                                                                                                                                      jmp 00007F5FD8807AB7h
                                                                                                                                      dec eax
                                                                                                                                      cmp ecx, eax
                                                                                                                                      je 00007F5FD8807AC6h
                                                                                                                                      xor eax, eax
                                                                                                                                      dec eax
                                                                                                                                      cmpxchg dword ptr [0003570Ch], ecx
                                                                                                                                      jne 00007F5FD8807AA0h
                                                                                                                                      xor al, al
                                                                                                                                      dec eax
                                                                                                                                      add esp, 28h
                                                                                                                                      ret
                                                                                                                                      mov al, 01h
                                                                                                                                      jmp 00007F5FD8807AA9h
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      dec eax
                                                                                                                                      sub esp, 28h
                                                                                                                                      test ecx, ecx
                                                                                                                                      jne 00007F5FD8807AB9h
                                                                                                                                      mov byte ptr [000356F5h], 00000001h
                                                                                                                                      call 00007F5FD8807205h
                                                                                                                                      call 00007F5FD88084F0h
                                                                                                                                      test al, al
                                                                                                                                      jne 00007F5FD8807AB6h
                                                                                                                                      xor al, al
                                                                                                                                      jmp 00007F5FD8807AC6h
                                                                                                                                      call 00007F5FD881500Fh
                                                                                                                                      test al, al
                                                                                                                                      jne 00007F5FD8807ABBh
                                                                                                                                      xor ecx, ecx
                                                                                                                                      call 00007F5FD8808500h
                                                                                                                                      jmp 00007F5FD8807A9Ch
                                                                                                                                      mov al, 01h
                                                                                                                                      dec eax
                                                                                                                                      add esp, 28h
                                                                                                                                      ret
                                                                                                                                      int3
                                                                                                                                      int3
                                                                                                                                      inc eax
                                                                                                                                      push ebx
                                                                                                                                      dec eax
                                                                                                                                      sub esp, 20h
                                                                                                                                      cmp byte ptr [000356BCh], 00000000h
                                                                                                                                      mov ebx, ecx
                                                                                                                                      jne 00007F5FD8807B19h
                                                                                                                                      cmp ecx, 01h
                                                                                                                                      jnbe 00007F5FD8807B1Ch
                                                                                                                                      call 00007F5FD880804Eh
                                                                                                                                      test eax, eax
                                                                                                                                      je 00007F5FD8807ADAh
                                                                                                                                      test ebx, ebx
                                                                                                                                      jne 00007F5FD8807AD6h
                                                                                                                                      dec eax
                                                                                                                                      lea ecx, dword ptr [000356A6h]
                                                                                                                                      call 00007F5FD8814E02h

                                                                                                                                      Data Directories

                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca340x78.rdata
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xeeb8.rsrc
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2238.pdata
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x560000x764.reloc
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                      Sections

                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                      .text0x10000x29f700x2a000b8c3814c5fb0b18492ad4ec2ffe0830aFalse0.5518740699404762data6.489205819736506IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                      .rdata0x2b0000x12a280x12c00e8823661b776fef9217099f5925df889False0.5242838541666667data5.750791770882582IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                      .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                      .pdata0x440000x22380x24009cd1eac931545f28ab09329f8bfce843False0.4697265625data5.2645170849678795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                      .rsrc0x470000xeeb80xf00084086ada0a1865a4173ecccf4a690c02False0.038167317708333336data2.343477032023029IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                      .reloc0x560000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                      Resources

                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                      RT_ICON0x470e80xe8acDevice independent bitmap graphic, 225 x 450 x 8, image size 51300, 256 important colors0.024964743804982877
                                                                                                                                      RT_GROUP_ICON0x559940x14data1.15
                                                                                                                                      RT_MANIFEST0x559a80x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                      Imports

                                                                                                                                      DLLImport
                                                                                                                                      USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                      COMCTL32.dll
                                                                                                                                      KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                      ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                      GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                      Network Behavior

                                                                                                                                      Network Port Distribution

                                                                                                                                      TCP Packets

                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                      Dec 18, 2024 08:50:21.637753963 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:21.757399082 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:21.757767916 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:21.770960093 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:21.890528917 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:22.959469080 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:22.960788965 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:23.080502033 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.080549955 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.191059113 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.191972971 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:23.311649084 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.634792089 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.646631956 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:23.766153097 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:23.766239882 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:23.886039019 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:24.379334927 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:24.382462025 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:24.502458096 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:24.827522993 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:24.828367949 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:24.947912931 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:25.018306017 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:25.064867020 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:25.265281916 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:25.265903950 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:25.385867119 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:25.702919006 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:25.703764915 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:25.824666977 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:26.141746998 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:26.150624990 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:26.270426989 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:26.587541103 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:26.593696117 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:26.713227987 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.030344009 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.034697056 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:27.154189110 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.471597910 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.472167015 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:27.591834068 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.908875942 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:27.910280943 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:27.910455942 CET4970522192.168.2.8130.193.51.109
                                                                                                                                      Dec 18, 2024 08:50:28.029941082 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:28.030390978 CET2249705130.193.51.109192.168.2.8
                                                                                                                                      Dec 18, 2024 08:50:28.030445099 CET4970522192.168.2.8130.193.51.109

                                                                                                                                      Statistics

                                                                                                                                      CPU Usage

                                                                                                                                      Click to jump to process

                                                                                                                                      Memory Usage

                                                                                                                                      Click to jump to process

                                                                                                                                      High Level Behavior Distribution

                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                      Behavior

                                                                                                                                      Click to jump to process

                                                                                                                                      System Behavior

                                                                                                                                      General

                                                                                                                                      Target ID:0
                                                                                                                                      Start time:02:50:17
                                                                                                                                      Start date:18/12/2024
                                                                                                                                      Path:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:"C:\Users\user\Desktop\Ao8sixO8Om.exe"
                                                                                                                                      Imagebase:0x7ff61de40000
                                                                                                                                      File size:11'373'110 bytes
                                                                                                                                      MD5 hash:CC0EE5BF6E42828AC49C73D1D112F338
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:low
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:2
                                                                                                                                      Start time:02:50:19
                                                                                                                                      Start date:18/12/2024
                                                                                                                                      Path:C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:"C:\Users\user\Desktop\Ao8sixO8Om.exe"
                                                                                                                                      Imagebase:0x7ff61de40000
                                                                                                                                      File size:11'373'110 bytes
                                                                                                                                      MD5 hash:CC0EE5BF6E42828AC49C73D1D112F338
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:low
                                                                                                                                      Has exited:true

                                                                                                                                      Disassembly

                                                                                                                                      Reset < >

                                                                                                                                        Execution Graph

                                                                                                                                        Execution Coverage:9.4%
                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                        Signature Coverage:14.2%
                                                                                                                                        Total number of Nodes:2000
                                                                                                                                        Total number of Limit Nodes:38
                                                                                                                                        execution_graph 16056 7ff61de4ccac 16077 7ff61de4ce7c 16056->16077 16059 7ff61de4cdf8 16231 7ff61de4d19c IsProcessorFeaturePresent 16059->16231 16060 7ff61de4ccc8 __scrt_acquire_startup_lock 16062 7ff61de4ce02 16060->16062 16069 7ff61de4cce6 __scrt_release_startup_lock 16060->16069 16063 7ff61de4d19c 7 API calls 16062->16063 16065 7ff61de4ce0d _CreateFrameInfo 16063->16065 16064 7ff61de4cd0b 16066 7ff61de4cd91 16083 7ff61de4d2e4 16066->16083 16068 7ff61de4cd96 16086 7ff61de41000 16068->16086 16069->16064 16069->16066 16220 7ff61de59b9c 16069->16220 16074 7ff61de4cdb9 16074->16065 16227 7ff61de4d000 16074->16227 16078 7ff61de4ce84 16077->16078 16079 7ff61de4ce90 __scrt_dllmain_crt_thread_attach 16078->16079 16080 7ff61de4ce9d 16079->16080 16082 7ff61de4ccc0 16079->16082 16080->16082 16238 7ff61de4d8f8 16080->16238 16082->16059 16082->16060 16265 7ff61de6a540 16083->16265 16087 7ff61de41009 16086->16087 16267 7ff61de554f4 16087->16267 16089 7ff61de437fb 16274 7ff61de436b0 16089->16274 16096 7ff61de4383c 16434 7ff61de41c80 16096->16434 16097 7ff61de4391b 16443 7ff61de445b0 16097->16443 16100 7ff61de4385b 16346 7ff61de48a20 16100->16346 16103 7ff61de4396a 16466 7ff61de42710 16103->16466 16104 7ff61de4388e 16114 7ff61de438bb __std_exception_destroy 16104->16114 16438 7ff61de48b90 16104->16438 16107 7ff61de4395d 16108 7ff61de43984 16107->16108 16109 7ff61de43962 16107->16109 16110 7ff61de41c80 49 API calls 16108->16110 16462 7ff61de500bc 16109->16462 16113 7ff61de439a3 16110->16113 16119 7ff61de41950 115 API calls 16113->16119 16115 7ff61de48a20 14 API calls 16114->16115 16122 7ff61de438de __std_exception_destroy 16114->16122 16115->16122 16117 7ff61de43a0b 16118 7ff61de48b90 40 API calls 16117->16118 16120 7ff61de43a17 16118->16120 16121 7ff61de439ce 16119->16121 16123 7ff61de48b90 40 API calls 16120->16123 16121->16100 16124 7ff61de439de 16121->16124 16128 7ff61de4390e __std_exception_destroy 16122->16128 16477 7ff61de48b30 16122->16477 16125 7ff61de43a23 16123->16125 16126 7ff61de42710 54 API calls 16124->16126 16127 7ff61de48b90 40 API calls 16125->16127 16134 7ff61de43808 __std_exception_destroy 16126->16134 16127->16128 16129 7ff61de48a20 14 API calls 16128->16129 16130 7ff61de43a3b 16129->16130 16131 7ff61de43b2f 16130->16131 16132 7ff61de43a60 __std_exception_destroy 16130->16132 16133 7ff61de42710 54 API calls 16131->16133 16135 7ff61de48b30 40 API calls 16132->16135 16144 7ff61de43aab 16132->16144 16133->16134 16484 7ff61de4c5c0 16134->16484 16135->16144 16136 7ff61de48a20 14 API calls 16137 7ff61de43bf4 __std_exception_destroy 16136->16137 16138 7ff61de43c46 16137->16138 16139 7ff61de43d41 16137->16139 16140 7ff61de43c50 16138->16140 16141 7ff61de43cd4 16138->16141 16493 7ff61de444d0 16139->16493 16359 7ff61de490e0 16140->16359 16146 7ff61de48a20 14 API calls 16141->16146 16143 7ff61de43d4f 16148 7ff61de43d71 16143->16148 16149 7ff61de43d65 16143->16149 16144->16136 16147 7ff61de43ce0 16146->16147 16151 7ff61de43c61 16147->16151 16154 7ff61de43ced 16147->16154 16153 7ff61de41c80 49 API calls 16148->16153 16496 7ff61de44620 16149->16496 16156 7ff61de42710 54 API calls 16151->16156 16162 7ff61de43cc8 __std_exception_destroy 16153->16162 16157 7ff61de41c80 49 API calls 16154->16157 16156->16134 16160 7ff61de43d0b 16157->16160 16158 7ff61de43dc4 16409 7ff61de49400 16158->16409 16160->16162 16163 7ff61de43d12 16160->16163 16162->16158 16164 7ff61de43da7 SetDllDirectoryW LoadLibraryExW 16162->16164 16166 7ff61de42710 54 API calls 16163->16166 16164->16158 16165 7ff61de43dd7 SetDllDirectoryW 16168 7ff61de43e0a 16165->16168 16209 7ff61de43e5a 16165->16209 16166->16134 16169 7ff61de48a20 14 API calls 16168->16169 16177 7ff61de43e16 __std_exception_destroy 16169->16177 16170 7ff61de43ffc 16172 7ff61de44029 16170->16172 16173 7ff61de44006 PostMessageW GetMessageW 16170->16173 16171 7ff61de43f1b 16414 7ff61de433c0 16171->16414 16573 7ff61de43360 16172->16573 16173->16172 16180 7ff61de43ef2 16177->16180 16184 7ff61de43e4e 16177->16184 16183 7ff61de48b30 40 API calls 16180->16183 16183->16209 16184->16209 16499 7ff61de46db0 16184->16499 16189 7ff61de46fb0 FreeLibrary 16191 7ff61de4404f 16189->16191 16197 7ff61de43e81 16200 7ff61de43ea2 16197->16200 16212 7ff61de43e85 16197->16212 16520 7ff61de46df0 16197->16520 16200->16212 16539 7ff61de471a0 16200->16539 16209->16170 16209->16171 16212->16209 16555 7ff61de42a50 16212->16555 16221 7ff61de59bb3 16220->16221 16222 7ff61de59bd4 16220->16222 16221->16066 18809 7ff61de5a448 16222->18809 16225 7ff61de4d328 GetModuleHandleW 16226 7ff61de4d339 16225->16226 16226->16074 16228 7ff61de4d011 16227->16228 16229 7ff61de4cdd0 16228->16229 16230 7ff61de4d8f8 7 API calls 16228->16230 16229->16064 16230->16229 16232 7ff61de4d1c2 _CreateFrameInfo memcpy_s 16231->16232 16233 7ff61de4d1e1 RtlCaptureContext RtlLookupFunctionEntry 16232->16233 16234 7ff61de4d20a RtlVirtualUnwind 16233->16234 16235 7ff61de4d246 memcpy_s 16233->16235 16234->16235 16236 7ff61de4d278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16235->16236 16237 7ff61de4d2c6 _CreateFrameInfo 16236->16237 16237->16062 16239 7ff61de4d90a 16238->16239 16240 7ff61de4d900 16238->16240 16239->16082 16244 7ff61de4dc94 16240->16244 16245 7ff61de4dca3 16244->16245 16246 7ff61de4d905 16244->16246 16252 7ff61de4ded0 16245->16252 16248 7ff61de4dd00 16246->16248 16249 7ff61de4dd2b 16248->16249 16250 7ff61de4dd0e DeleteCriticalSection 16249->16250 16251 7ff61de4dd2f 16249->16251 16250->16249 16251->16239 16256 7ff61de4dd38 16252->16256 16257 7ff61de4de22 TlsFree 16256->16257 16263 7ff61de4dd7c __vcrt_FlsAlloc 16256->16263 16258 7ff61de4ddaa LoadLibraryExW 16260 7ff61de4ddcb GetLastError 16258->16260 16261 7ff61de4de49 16258->16261 16259 7ff61de4de69 GetProcAddress 16259->16257 16260->16263 16261->16259 16262 7ff61de4de60 FreeLibrary 16261->16262 16262->16259 16263->16257 16263->16258 16263->16259 16264 7ff61de4dded LoadLibraryExW 16263->16264 16264->16261 16264->16263 16266 7ff61de4d2fb GetStartupInfoW 16265->16266 16266->16068 16269 7ff61de5f4f0 16267->16269 16268 7ff61de5f543 16586 7ff61de5a884 16268->16586 16269->16268 16271 7ff61de5f596 16269->16271 16596 7ff61de5f3c8 16271->16596 16273 7ff61de5f56c 16273->16089 16703 7ff61de4c8c0 16274->16703 16277 7ff61de436eb GetLastError 16710 7ff61de42c50 16277->16710 16278 7ff61de43710 16705 7ff61de492f0 FindFirstFileExW 16278->16705 16281 7ff61de43706 16285 7ff61de4c5c0 _log10_special 8 API calls 16281->16285 16283 7ff61de4377d 16736 7ff61de494b0 16283->16736 16284 7ff61de43723 16725 7ff61de49370 CreateFileW 16284->16725 16288 7ff61de437b5 16285->16288 16288->16134 16296 7ff61de41950 16288->16296 16290 7ff61de4378b 16290->16281 16293 7ff61de42810 49 API calls 16290->16293 16291 7ff61de4374c __vcrt_FlsAlloc 16291->16283 16292 7ff61de43734 16728 7ff61de42810 16292->16728 16293->16281 16297 7ff61de445b0 108 API calls 16296->16297 16298 7ff61de41985 16297->16298 16299 7ff61de41c43 16298->16299 16301 7ff61de47f80 83 API calls 16298->16301 16300 7ff61de4c5c0 _log10_special 8 API calls 16299->16300 16302 7ff61de41c5e 16300->16302 16303 7ff61de419cb 16301->16303 16302->16096 16302->16097 16345 7ff61de41a03 16303->16345 17141 7ff61de50744 16303->17141 16304 7ff61de500bc 74 API calls 16304->16299 16306 7ff61de419e5 16307 7ff61de419e9 16306->16307 16308 7ff61de41a08 16306->16308 16309 7ff61de54f78 _get_daylight 11 API calls 16307->16309 17145 7ff61de5040c 16308->17145 16311 7ff61de419ee 16309->16311 17148 7ff61de42910 16311->17148 16314 7ff61de41a26 16316 7ff61de54f78 _get_daylight 11 API calls 16314->16316 16315 7ff61de41a45 16318 7ff61de41a5c 16315->16318 16319 7ff61de41a7b 16315->16319 16317 7ff61de41a2b 16316->16317 16320 7ff61de42910 54 API calls 16317->16320 16321 7ff61de54f78 _get_daylight 11 API calls 16318->16321 16322 7ff61de41c80 49 API calls 16319->16322 16320->16345 16323 7ff61de41a61 16321->16323 16324 7ff61de41a92 16322->16324 16325 7ff61de42910 54 API calls 16323->16325 16326 7ff61de41c80 49 API calls 16324->16326 16325->16345 16327 7ff61de41add 16326->16327 16328 7ff61de50744 73 API calls 16327->16328 16329 7ff61de41b01 16328->16329 16330 7ff61de41b16 16329->16330 16331 7ff61de41b35 16329->16331 16333 7ff61de54f78 _get_daylight 11 API calls 16330->16333 16332 7ff61de5040c _fread_nolock 53 API calls 16331->16332 16335 7ff61de41b4a 16332->16335 16334 7ff61de41b1b 16333->16334 16336 7ff61de42910 54 API calls 16334->16336 16337 7ff61de41b50 16335->16337 16338 7ff61de41b6f 16335->16338 16336->16345 16339 7ff61de54f78 _get_daylight 11 API calls 16337->16339 17163 7ff61de50180 16338->17163 16341 7ff61de41b55 16339->16341 16343 7ff61de42910 54 API calls 16341->16343 16343->16345 16344 7ff61de42710 54 API calls 16344->16345 16345->16304 16347 7ff61de48a2a 16346->16347 16348 7ff61de49400 2 API calls 16347->16348 16349 7ff61de48a49 GetEnvironmentVariableW 16348->16349 16350 7ff61de48a66 ExpandEnvironmentStringsW 16349->16350 16351 7ff61de48ab2 16349->16351 16350->16351 16352 7ff61de48a88 16350->16352 16353 7ff61de4c5c0 _log10_special 8 API calls 16351->16353 16355 7ff61de494b0 2 API calls 16352->16355 16354 7ff61de48ac4 16353->16354 16354->16104 16356 7ff61de48a9a 16355->16356 16357 7ff61de4c5c0 _log10_special 8 API calls 16356->16357 16358 7ff61de48aaa 16357->16358 16358->16104 16360 7ff61de490f5 16359->16360 17381 7ff61de48760 GetCurrentProcess OpenProcessToken 16360->17381 16363 7ff61de48760 7 API calls 16364 7ff61de49121 16363->16364 16365 7ff61de4913a 16364->16365 16366 7ff61de49154 16364->16366 16367 7ff61de426b0 48 API calls 16365->16367 16368 7ff61de426b0 48 API calls 16366->16368 16369 7ff61de49152 16367->16369 16370 7ff61de49167 LocalFree LocalFree 16368->16370 16369->16370 16371 7ff61de49183 16370->16371 16374 7ff61de4918f 16370->16374 17391 7ff61de42b50 16371->17391 16373 7ff61de4c5c0 _log10_special 8 API calls 16375 7ff61de43c55 16373->16375 16374->16373 16375->16151 16376 7ff61de48850 16375->16376 16377 7ff61de48868 16376->16377 16378 7ff61de488ea GetTempPathW GetCurrentProcessId 16377->16378 16379 7ff61de4888c 16377->16379 17400 7ff61de425c0 16378->17400 16381 7ff61de48a20 14 API calls 16379->16381 16382 7ff61de48898 16381->16382 17407 7ff61de481c0 16382->17407 16389 7ff61de488be __std_exception_destroy 16389->16378 16397 7ff61de488cc 16389->16397 16391 7ff61de488d8 __std_exception_destroy 16408 7ff61de489c4 __std_exception_destroy 16391->16408 16392 7ff61de48918 __std_exception_destroy 16395 7ff61de48955 __std_exception_destroy 16392->16395 17404 7ff61de58bd8 16392->17404 16394 7ff61de4c5c0 _log10_special 8 API calls 16396 7ff61de43cbb 16394->16396 16400 7ff61de49400 2 API calls 16395->16400 16395->16408 16396->16151 16396->16162 16399 7ff61de42810 49 API calls 16397->16399 16399->16391 16401 7ff61de489a1 16400->16401 16402 7ff61de489a6 16401->16402 16403 7ff61de489d9 16401->16403 16405 7ff61de49400 2 API calls 16402->16405 16404 7ff61de582a8 38 API calls 16403->16404 16404->16408 16406 7ff61de489b6 16405->16406 16407 7ff61de582a8 38 API calls 16406->16407 16407->16408 16408->16394 16410 7ff61de49422 MultiByteToWideChar 16409->16410 16411 7ff61de49446 16409->16411 16410->16411 16413 7ff61de4945c __std_exception_destroy 16410->16413 16412 7ff61de49463 MultiByteToWideChar 16411->16412 16411->16413 16412->16413 16413->16165 16420 7ff61de433ce memcpy_s 16414->16420 16415 7ff61de435c7 16416 7ff61de4c5c0 _log10_special 8 API calls 16415->16416 16417 7ff61de43664 16416->16417 16417->16134 16433 7ff61de490c0 LocalFree 16417->16433 16419 7ff61de41c80 49 API calls 16419->16420 16420->16415 16420->16419 16425 7ff61de435c9 16420->16425 16426 7ff61de435e2 16420->16426 16427 7ff61de42a50 54 API calls 16420->16427 16431 7ff61de435d0 16420->16431 17696 7ff61de44550 16420->17696 17702 7ff61de47e10 16420->17702 17713 7ff61de41600 16420->17713 17761 7ff61de47110 16420->17761 17765 7ff61de44180 16420->17765 17809 7ff61de44440 16420->17809 16422 7ff61de42710 54 API calls 16422->16415 16428 7ff61de42710 54 API calls 16425->16428 16426->16422 16427->16420 16428->16415 16432 7ff61de42710 54 API calls 16431->16432 16432->16415 16435 7ff61de41ca5 16434->16435 16436 7ff61de549f4 49 API calls 16435->16436 16437 7ff61de41cc8 16436->16437 16437->16100 16439 7ff61de49400 2 API calls 16438->16439 16440 7ff61de48ba4 16439->16440 16441 7ff61de582a8 38 API calls 16440->16441 16442 7ff61de48bb6 __std_exception_destroy 16441->16442 16442->16114 16444 7ff61de445bc 16443->16444 16445 7ff61de49400 2 API calls 16444->16445 16446 7ff61de445e4 16445->16446 16447 7ff61de49400 2 API calls 16446->16447 16448 7ff61de445f7 16447->16448 17992 7ff61de56004 16448->17992 16451 7ff61de4c5c0 _log10_special 8 API calls 16452 7ff61de4392b 16451->16452 16452->16103 16453 7ff61de47f80 16452->16453 16454 7ff61de47fa4 16453->16454 16455 7ff61de50744 73 API calls 16454->16455 16460 7ff61de4807b __std_exception_destroy 16454->16460 16456 7ff61de47fc0 16455->16456 16456->16460 18383 7ff61de57938 16456->18383 16458 7ff61de50744 73 API calls 16461 7ff61de47fd5 16458->16461 16459 7ff61de5040c _fread_nolock 53 API calls 16459->16461 16460->16107 16461->16458 16461->16459 16461->16460 16463 7ff61de500ec 16462->16463 18398 7ff61de4fe98 16463->18398 16465 7ff61de50105 16465->16103 16467 7ff61de4c8c0 16466->16467 16468 7ff61de42734 GetCurrentProcessId 16467->16468 16469 7ff61de41c80 49 API calls 16468->16469 16470 7ff61de42787 16469->16470 16471 7ff61de549f4 49 API calls 16470->16471 16472 7ff61de427cf 16471->16472 16473 7ff61de42620 12 API calls 16472->16473 16474 7ff61de427f1 16473->16474 16475 7ff61de4c5c0 _log10_special 8 API calls 16474->16475 16476 7ff61de42801 16475->16476 16476->16134 16478 7ff61de49400 2 API calls 16477->16478 16479 7ff61de48b4c 16478->16479 16480 7ff61de49400 2 API calls 16479->16480 16481 7ff61de48b5c 16480->16481 16482 7ff61de582a8 38 API calls 16481->16482 16483 7ff61de48b6a __std_exception_destroy 16482->16483 16483->16117 16485 7ff61de4c5c9 16484->16485 16486 7ff61de43ca7 16485->16486 16487 7ff61de4c950 IsProcessorFeaturePresent 16485->16487 16486->16225 16488 7ff61de4c968 16487->16488 18409 7ff61de4cb48 RtlCaptureContext 16488->18409 16494 7ff61de41c80 49 API calls 16493->16494 16495 7ff61de444ed 16494->16495 16495->16143 16497 7ff61de41c80 49 API calls 16496->16497 16498 7ff61de44650 16497->16498 16498->16162 16500 7ff61de46dc5 16499->16500 16501 7ff61de43e6c 16500->16501 16502 7ff61de54f78 _get_daylight 11 API calls 16500->16502 16505 7ff61de47330 16501->16505 16503 7ff61de46dd2 16502->16503 16504 7ff61de42910 54 API calls 16503->16504 16504->16501 18414 7ff61de41470 16505->18414 16507 7ff61de47358 16508 7ff61de44620 49 API calls 16507->16508 16514 7ff61de474a9 __std_exception_destroy 16507->16514 16509 7ff61de4737a 16508->16509 16510 7ff61de4737f 16509->16510 16511 7ff61de44620 49 API calls 16509->16511 16512 7ff61de42a50 54 API calls 16510->16512 16513 7ff61de4739e 16511->16513 16512->16514 16513->16510 16515 7ff61de44620 49 API calls 16513->16515 16514->16197 16516 7ff61de473ba 16515->16516 16516->16510 16517 7ff61de473c3 16516->16517 16518 7ff61de42710 54 API calls 16517->16518 16519 7ff61de47433 __std_exception_destroy memcpy_s 16517->16519 16518->16514 16519->16197 16533 7ff61de46e0c 16520->16533 16521 7ff61de4c5c0 _log10_special 8 API calls 16522 7ff61de46f41 16521->16522 16522->16200 16523 7ff61de41840 45 API calls 16523->16533 16524 7ff61de46f9a 16526 7ff61de42710 54 API calls 16524->16526 16525 7ff61de41c80 49 API calls 16525->16533 16527 7ff61de46f2f 16526->16527 16527->16521 16528 7ff61de46f87 16530 7ff61de42710 54 API calls 16528->16530 16529 7ff61de44550 10 API calls 16529->16533 16530->16527 16531 7ff61de47e10 52 API calls 16531->16533 16532 7ff61de42a50 54 API calls 16532->16533 16533->16523 16533->16524 16533->16525 16533->16527 16533->16528 16533->16529 16533->16531 16533->16532 16534 7ff61de46f74 16533->16534 16536 7ff61de41600 118 API calls 16533->16536 16537 7ff61de46f5d 16533->16537 16535 7ff61de42710 54 API calls 16534->16535 16535->16527 16536->16533 16538 7ff61de42710 54 API calls 16537->16538 16538->16527 18444 7ff61de49070 16539->18444 16541 7ff61de471b9 16542 7ff61de49070 3 API calls 16541->16542 16543 7ff61de471cc 16542->16543 16544 7ff61de471ff 16543->16544 16545 7ff61de471e4 16543->16545 16546 7ff61de42710 54 API calls 16544->16546 18448 7ff61de476b0 GetProcAddress 16545->18448 16556 7ff61de4c8c0 16555->16556 16557 7ff61de42a74 GetCurrentProcessId 16556->16557 16558 7ff61de41c80 49 API calls 16557->16558 16559 7ff61de42ac7 16558->16559 16560 7ff61de549f4 49 API calls 16559->16560 16561 7ff61de42b0f 16560->16561 16562 7ff61de42620 12 API calls 16561->16562 16563 7ff61de42b31 16562->16563 18520 7ff61de46350 16573->18520 16577 7ff61de43381 16581 7ff61de43399 16577->16581 18588 7ff61de46040 16577->18588 16579 7ff61de4338d 16579->16581 18597 7ff61de461d0 16579->18597 16582 7ff61de43670 16581->16582 16583 7ff61de4367e 16582->16583 16584 7ff61de4368f 16583->16584 18808 7ff61de49050 FreeLibrary 16583->18808 16584->16189 16603 7ff61de5a5cc 16586->16603 16592 7ff61de5a8bf 16592->16273 16702 7ff61de554dc EnterCriticalSection 16596->16702 16604 7ff61de5a5e8 GetLastError 16603->16604 16605 7ff61de5a623 16603->16605 16606 7ff61de5a5f8 16604->16606 16605->16592 16609 7ff61de5a638 16605->16609 16616 7ff61de5b400 16606->16616 16610 7ff61de5a66c 16609->16610 16611 7ff61de5a654 GetLastError SetLastError 16609->16611 16610->16592 16612 7ff61de5a970 IsProcessorFeaturePresent 16610->16612 16611->16610 16613 7ff61de5a983 16612->16613 16694 7ff61de5a684 16613->16694 16617 7ff61de5b43a FlsSetValue 16616->16617 16618 7ff61de5b41f FlsGetValue 16616->16618 16619 7ff61de5b447 16617->16619 16630 7ff61de5a613 SetLastError 16617->16630 16620 7ff61de5b434 16618->16620 16618->16630 16633 7ff61de5ec08 16619->16633 16620->16617 16623 7ff61de5b474 FlsSetValue 16626 7ff61de5b492 16623->16626 16627 7ff61de5b480 FlsSetValue 16623->16627 16624 7ff61de5b464 FlsSetValue 16625 7ff61de5b46d 16624->16625 16640 7ff61de5a9b8 16625->16640 16646 7ff61de5af64 16626->16646 16627->16625 16630->16605 16638 7ff61de5ec19 _get_daylight 16633->16638 16634 7ff61de5ec6a 16654 7ff61de54f78 16634->16654 16635 7ff61de5ec4e HeapAlloc 16636 7ff61de5b456 16635->16636 16635->16638 16636->16623 16636->16624 16638->16634 16638->16635 16651 7ff61de63600 16638->16651 16641 7ff61de5a9bd RtlFreeHeap 16640->16641 16642 7ff61de5a9ec 16640->16642 16641->16642 16643 7ff61de5a9d8 GetLastError 16641->16643 16642->16630 16644 7ff61de5a9e5 __free_lconv_num 16643->16644 16645 7ff61de54f78 _get_daylight 9 API calls 16644->16645 16645->16642 16680 7ff61de5ae3c 16646->16680 16657 7ff61de63640 16651->16657 16663 7ff61de5b338 GetLastError 16654->16663 16656 7ff61de54f81 16656->16636 16662 7ff61de60348 EnterCriticalSection 16657->16662 16664 7ff61de5b379 FlsSetValue 16663->16664 16667 7ff61de5b35c 16663->16667 16665 7ff61de5b38b 16664->16665 16666 7ff61de5b369 16664->16666 16669 7ff61de5ec08 _get_daylight 5 API calls 16665->16669 16668 7ff61de5b3e5 SetLastError 16666->16668 16667->16664 16667->16666 16668->16656 16670 7ff61de5b39a 16669->16670 16671 7ff61de5b3b8 FlsSetValue 16670->16671 16672 7ff61de5b3a8 FlsSetValue 16670->16672 16673 7ff61de5b3d6 16671->16673 16674 7ff61de5b3c4 FlsSetValue 16671->16674 16675 7ff61de5b3b1 16672->16675 16676 7ff61de5af64 _get_daylight 5 API calls 16673->16676 16674->16675 16677 7ff61de5a9b8 __free_lconv_num 5 API calls 16675->16677 16678 7ff61de5b3de 16676->16678 16677->16666 16679 7ff61de5a9b8 __free_lconv_num 5 API calls 16678->16679 16679->16668 16692 7ff61de60348 EnterCriticalSection 16680->16692 16695 7ff61de5a6be _CreateFrameInfo memcpy_s 16694->16695 16696 7ff61de5a6e6 RtlCaptureContext RtlLookupFunctionEntry 16695->16696 16697 7ff61de5a756 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16696->16697 16698 7ff61de5a720 RtlVirtualUnwind 16696->16698 16699 7ff61de5a7a8 _CreateFrameInfo 16697->16699 16698->16697 16700 7ff61de4c5c0 _log10_special 8 API calls 16699->16700 16701 7ff61de5a7c7 GetCurrentProcess TerminateProcess 16700->16701 16704 7ff61de436bc GetModuleFileNameW 16703->16704 16704->16277 16704->16278 16706 7ff61de4932f FindClose 16705->16706 16707 7ff61de49342 16705->16707 16706->16707 16708 7ff61de4c5c0 _log10_special 8 API calls 16707->16708 16709 7ff61de4371a 16708->16709 16709->16283 16709->16284 16711 7ff61de4c8c0 16710->16711 16712 7ff61de42c70 GetCurrentProcessId 16711->16712 16741 7ff61de426b0 16712->16741 16714 7ff61de42cb9 16745 7ff61de54c48 16714->16745 16717 7ff61de426b0 48 API calls 16718 7ff61de42d34 FormatMessageW 16717->16718 16720 7ff61de42d6d 16718->16720 16721 7ff61de42d7f MessageBoxW 16718->16721 16722 7ff61de426b0 48 API calls 16720->16722 16723 7ff61de4c5c0 _log10_special 8 API calls 16721->16723 16722->16721 16724 7ff61de42daf 16723->16724 16724->16281 16726 7ff61de43730 16725->16726 16727 7ff61de493b0 GetFinalPathNameByHandleW CloseHandle 16725->16727 16726->16291 16726->16292 16727->16726 16729 7ff61de42834 16728->16729 16730 7ff61de426b0 48 API calls 16729->16730 16731 7ff61de42887 16730->16731 16732 7ff61de54c48 48 API calls 16731->16732 16733 7ff61de428d0 MessageBoxW 16732->16733 16734 7ff61de4c5c0 _log10_special 8 API calls 16733->16734 16735 7ff61de42900 16734->16735 16735->16281 16737 7ff61de494da WideCharToMultiByte 16736->16737 16739 7ff61de49505 16736->16739 16737->16739 16740 7ff61de4951b __std_exception_destroy 16737->16740 16738 7ff61de49522 WideCharToMultiByte 16738->16740 16739->16738 16739->16740 16740->16290 16742 7ff61de426d5 16741->16742 16743 7ff61de54c48 48 API calls 16742->16743 16744 7ff61de426f8 16743->16744 16744->16714 16749 7ff61de54ca2 16745->16749 16746 7ff61de54cc7 16747 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16746->16747 16751 7ff61de54cf1 16747->16751 16748 7ff61de54d03 16763 7ff61de53000 16748->16763 16749->16746 16749->16748 16753 7ff61de4c5c0 _log10_special 8 API calls 16751->16753 16752 7ff61de54de4 16754 7ff61de5a9b8 __free_lconv_num 11 API calls 16752->16754 16756 7ff61de42d04 16753->16756 16754->16751 16756->16717 16757 7ff61de54e0a 16757->16752 16759 7ff61de54e14 16757->16759 16758 7ff61de54db9 16760 7ff61de5a9b8 __free_lconv_num 11 API calls 16758->16760 16762 7ff61de5a9b8 __free_lconv_num 11 API calls 16759->16762 16760->16751 16761 7ff61de54db0 16761->16752 16761->16758 16762->16751 16764 7ff61de5303e 16763->16764 16765 7ff61de5302e 16763->16765 16766 7ff61de53047 16764->16766 16771 7ff61de53075 16764->16771 16768 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16765->16768 16769 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16766->16769 16767 7ff61de5306d 16767->16752 16767->16757 16767->16758 16767->16761 16768->16767 16769->16767 16771->16765 16771->16767 16774 7ff61de53a14 16771->16774 16807 7ff61de53460 16771->16807 16844 7ff61de52bf0 16771->16844 16775 7ff61de53a56 16774->16775 16776 7ff61de53ac7 16774->16776 16777 7ff61de53a5c 16775->16777 16778 7ff61de53af1 16775->16778 16779 7ff61de53acc 16776->16779 16780 7ff61de53b20 16776->16780 16781 7ff61de53a90 16777->16781 16782 7ff61de53a61 16777->16782 16867 7ff61de51dc4 16778->16867 16783 7ff61de53ace 16779->16783 16784 7ff61de53b01 16779->16784 16785 7ff61de53b2a 16780->16785 16786 7ff61de53b37 16780->16786 16791 7ff61de53b2f 16780->16791 16788 7ff61de53a67 16781->16788 16781->16791 16782->16786 16782->16788 16789 7ff61de53a70 16783->16789 16794 7ff61de53add 16783->16794 16874 7ff61de519b4 16784->16874 16785->16778 16785->16791 16881 7ff61de5471c 16786->16881 16788->16789 16795 7ff61de53aa2 16788->16795 16804 7ff61de53a8b 16788->16804 16805 7ff61de53b60 16789->16805 16847 7ff61de541c8 16789->16847 16791->16805 16885 7ff61de521d4 16791->16885 16794->16778 16797 7ff61de53ae2 16794->16797 16795->16805 16857 7ff61de54504 16795->16857 16797->16805 16863 7ff61de545c8 16797->16863 16799 7ff61de4c5c0 _log10_special 8 API calls 16801 7ff61de53e5a 16799->16801 16801->16771 16804->16805 16806 7ff61de53d4c 16804->16806 16892 7ff61de54830 16804->16892 16805->16799 16806->16805 16898 7ff61de5ea78 16806->16898 16808 7ff61de5346e 16807->16808 16809 7ff61de53484 16807->16809 16811 7ff61de53a56 16808->16811 16812 7ff61de53ac7 16808->16812 16833 7ff61de534c4 16808->16833 16810 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16809->16810 16809->16833 16810->16833 16813 7ff61de53a5c 16811->16813 16814 7ff61de53af1 16811->16814 16815 7ff61de53acc 16812->16815 16816 7ff61de53b20 16812->16816 16817 7ff61de53a90 16813->16817 16818 7ff61de53a61 16813->16818 16823 7ff61de51dc4 38 API calls 16814->16823 16819 7ff61de53ace 16815->16819 16820 7ff61de53b01 16815->16820 16821 7ff61de53b2a 16816->16821 16822 7ff61de53b37 16816->16822 16827 7ff61de53b2f 16816->16827 16824 7ff61de53a67 16817->16824 16817->16827 16818->16822 16818->16824 16825 7ff61de53a70 16819->16825 16832 7ff61de53add 16819->16832 16829 7ff61de519b4 38 API calls 16820->16829 16821->16814 16821->16827 16828 7ff61de5471c 45 API calls 16822->16828 16841 7ff61de53a8b 16823->16841 16824->16825 16830 7ff61de53aa2 16824->16830 16824->16841 16826 7ff61de541c8 47 API calls 16825->16826 16842 7ff61de53b60 16825->16842 16826->16841 16831 7ff61de521d4 38 API calls 16827->16831 16827->16842 16828->16841 16829->16841 16834 7ff61de54504 46 API calls 16830->16834 16830->16842 16831->16841 16832->16814 16835 7ff61de53ae2 16832->16835 16833->16771 16834->16841 16837 7ff61de545c8 37 API calls 16835->16837 16835->16842 16836 7ff61de4c5c0 _log10_special 8 API calls 16838 7ff61de53e5a 16836->16838 16837->16841 16838->16771 16839 7ff61de54830 45 API calls 16843 7ff61de53d4c 16839->16843 16840 7ff61de5ea78 46 API calls 16840->16843 16841->16839 16841->16842 16841->16843 16842->16836 16843->16840 16843->16842 17124 7ff61de51038 16844->17124 16848 7ff61de541ee 16847->16848 16910 7ff61de50bf0 16848->16910 16853 7ff61de54333 16854 7ff61de543c1 16853->16854 16856 7ff61de54830 45 API calls 16853->16856 16854->16804 16855 7ff61de54830 45 API calls 16855->16853 16856->16854 16858 7ff61de54539 16857->16858 16859 7ff61de5457e 16858->16859 16860 7ff61de54557 16858->16860 16861 7ff61de54830 45 API calls 16858->16861 16859->16804 16862 7ff61de5ea78 46 API calls 16860->16862 16861->16860 16862->16859 16866 7ff61de545e9 16863->16866 16864 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16865 7ff61de5461a 16864->16865 16865->16804 16866->16864 16866->16865 16868 7ff61de51df7 16867->16868 16869 7ff61de51e26 16868->16869 16871 7ff61de51ee3 16868->16871 16873 7ff61de51e63 16869->16873 17056 7ff61de50c98 16869->17056 16872 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16871->16872 16872->16873 16873->16804 16875 7ff61de519e7 16874->16875 16876 7ff61de51a16 16875->16876 16878 7ff61de51ad3 16875->16878 16877 7ff61de50c98 12 API calls 16876->16877 16880 7ff61de51a53 16876->16880 16877->16880 16879 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16878->16879 16879->16880 16880->16804 16882 7ff61de5475f 16881->16882 16884 7ff61de54763 __crtLCMapStringW 16882->16884 17064 7ff61de547b8 16882->17064 16884->16804 16886 7ff61de52207 16885->16886 16887 7ff61de52236 16886->16887 16889 7ff61de522f3 16886->16889 16888 7ff61de50c98 12 API calls 16887->16888 16891 7ff61de52273 16887->16891 16888->16891 16890 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16889->16890 16890->16891 16891->16804 16893 7ff61de54847 16892->16893 17068 7ff61de5da28 16893->17068 16899 7ff61de5eaa9 16898->16899 16900 7ff61de5eab7 16898->16900 16899->16900 16901 7ff61de5ead7 16899->16901 16902 7ff61de54830 45 API calls 16899->16902 16900->16806 16903 7ff61de5eae8 16901->16903 16904 7ff61de5eb0f 16901->16904 16902->16901 17114 7ff61de60110 16903->17114 16904->16900 16906 7ff61de5eb9a 16904->16906 16907 7ff61de5eb39 16904->16907 16908 7ff61de5f910 _fread_nolock MultiByteToWideChar 16906->16908 16907->16900 17117 7ff61de5f910 16907->17117 16908->16900 16911 7ff61de50c27 16910->16911 16917 7ff61de50c16 16910->16917 16911->16917 16940 7ff61de5d66c 16911->16940 16914 7ff61de50c68 16916 7ff61de5a9b8 __free_lconv_num 11 API calls 16914->16916 16915 7ff61de5a9b8 __free_lconv_num 11 API calls 16915->16914 16916->16917 16918 7ff61de5e5e0 16917->16918 16919 7ff61de5e5fd 16918->16919 16920 7ff61de5e630 16918->16920 16921 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16919->16921 16920->16919 16923 7ff61de5e662 16920->16923 16922 7ff61de54311 16921->16922 16922->16853 16922->16855 16929 7ff61de5e775 16923->16929 16935 7ff61de5e6aa 16923->16935 16924 7ff61de5e867 16980 7ff61de5dacc 16924->16980 16926 7ff61de5e82d 16973 7ff61de5de64 16926->16973 16928 7ff61de5e7fc 16966 7ff61de5e144 16928->16966 16929->16924 16929->16926 16929->16928 16931 7ff61de5e7bf 16929->16931 16932 7ff61de5e7b5 16929->16932 16956 7ff61de5e374 16931->16956 16932->16926 16934 7ff61de5e7ba 16932->16934 16934->16928 16934->16931 16935->16922 16947 7ff61de5a514 16935->16947 16938 7ff61de5a970 _isindst 17 API calls 16939 7ff61de5e8c4 16938->16939 16941 7ff61de5d6b7 16940->16941 16945 7ff61de5d67b _get_daylight 16940->16945 16942 7ff61de54f78 _get_daylight 11 API calls 16941->16942 16944 7ff61de50c54 16942->16944 16943 7ff61de5d69e HeapAlloc 16943->16944 16943->16945 16944->16914 16944->16915 16945->16941 16945->16943 16946 7ff61de63600 _get_daylight 2 API calls 16945->16946 16946->16945 16948 7ff61de5a52b 16947->16948 16949 7ff61de5a521 16947->16949 16950 7ff61de54f78 _get_daylight 11 API calls 16948->16950 16949->16948 16954 7ff61de5a546 16949->16954 16951 7ff61de5a532 16950->16951 16989 7ff61de5a950 16951->16989 16953 7ff61de5a53e 16953->16922 16953->16938 16954->16953 16955 7ff61de54f78 _get_daylight 11 API calls 16954->16955 16955->16951 16992 7ff61de6411c 16956->16992 16960 7ff61de5e41c 16961 7ff61de5e471 16960->16961 16963 7ff61de5e43c 16960->16963 16965 7ff61de5e420 16960->16965 17045 7ff61de5df60 16961->17045 16963->16963 17041 7ff61de5e21c 16963->17041 16965->16922 16967 7ff61de6411c 38 API calls 16966->16967 16968 7ff61de5e18e 16967->16968 16969 7ff61de63b64 37 API calls 16968->16969 16970 7ff61de5e1de 16969->16970 16971 7ff61de5e1e2 16970->16971 16972 7ff61de5e21c 45 API calls 16970->16972 16971->16922 16972->16971 16974 7ff61de6411c 38 API calls 16973->16974 16975 7ff61de5deaf 16974->16975 16976 7ff61de63b64 37 API calls 16975->16976 16977 7ff61de5df07 16976->16977 16978 7ff61de5df0b 16977->16978 16979 7ff61de5df60 45 API calls 16977->16979 16978->16922 16979->16978 16981 7ff61de5db44 16980->16981 16982 7ff61de5db11 16980->16982 16984 7ff61de5db5c 16981->16984 16987 7ff61de5dbdd 16981->16987 16983 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 16982->16983 16986 7ff61de5db3d memcpy_s 16983->16986 16985 7ff61de5de64 46 API calls 16984->16985 16985->16986 16986->16922 16987->16986 16988 7ff61de54830 45 API calls 16987->16988 16988->16986 16990 7ff61de5a7e8 _invalid_parameter_noinfo 37 API calls 16989->16990 16991 7ff61de5a969 16990->16991 16991->16953 16993 7ff61de6416f fegetenv 16992->16993 16994 7ff61de67e9c 37 API calls 16993->16994 16997 7ff61de641c2 16994->16997 16995 7ff61de642b2 16996 7ff61de67e9c 37 API calls 16995->16996 16998 7ff61de642dc 16996->16998 16997->16995 17000 7ff61de6428c 16997->17000 17006 7ff61de641dd 16997->17006 17001 7ff61de67e9c 37 API calls 16998->17001 16999 7ff61de5a514 __std_exception_copy 37 API calls 17009 7ff61de6426d 16999->17009 17004 7ff61de5a514 __std_exception_copy 37 API calls 17000->17004 17002 7ff61de642ed 17001->17002 17007 7ff61de68090 20 API calls 17002->17007 17003 7ff61de65394 17008 7ff61de5a970 _isindst 17 API calls 17003->17008 17004->17009 17005 7ff61de641ef 17005->16999 17006->16995 17006->17005 17019 7ff61de64356 memcpy_s 17007->17019 17010 7ff61de653a9 17008->17010 17009->17003 17011 7ff61de64275 17009->17011 17012 7ff61de4c5c0 _log10_special 8 API calls 17011->17012 17013 7ff61de5e3c1 17012->17013 17037 7ff61de63b64 17013->17037 17014 7ff61de646ff memcpy_s 17015 7ff61de64a3f 17016 7ff61de63c80 37 API calls 17015->17016 17023 7ff61de65157 17016->17023 17017 7ff61de649eb 17017->17015 17020 7ff61de653ac memcpy_s 37 API calls 17017->17020 17018 7ff61de64397 memcpy_s 17030 7ff61de64cdb memcpy_s 17018->17030 17034 7ff61de647f3 memcpy_s 17018->17034 17019->17014 17019->17018 17021 7ff61de54f78 _get_daylight 11 API calls 17019->17021 17020->17015 17022 7ff61de647d0 17021->17022 17024 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17022->17024 17025 7ff61de653ac memcpy_s 37 API calls 17023->17025 17036 7ff61de651b2 17023->17036 17024->17018 17025->17036 17026 7ff61de65338 17027 7ff61de67e9c 37 API calls 17026->17027 17027->17011 17028 7ff61de54f78 11 API calls _get_daylight 17028->17030 17029 7ff61de54f78 11 API calls _get_daylight 17029->17034 17030->17015 17030->17017 17030->17028 17032 7ff61de5a950 37 API calls _invalid_parameter_noinfo 17030->17032 17031 7ff61de63c80 37 API calls 17031->17036 17032->17030 17033 7ff61de5a950 37 API calls _invalid_parameter_noinfo 17033->17034 17034->17017 17034->17029 17034->17033 17035 7ff61de653ac memcpy_s 37 API calls 17035->17036 17036->17026 17036->17031 17036->17035 17038 7ff61de63b83 17037->17038 17039 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17038->17039 17040 7ff61de63bae memcpy_s 17038->17040 17039->17040 17040->16960 17042 7ff61de5e248 memcpy_s 17041->17042 17043 7ff61de54830 45 API calls 17042->17043 17044 7ff61de5e302 memcpy_s 17042->17044 17043->17044 17044->16965 17046 7ff61de5df9b 17045->17046 17050 7ff61de5dfe8 memcpy_s 17045->17050 17047 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17046->17047 17048 7ff61de5dfc7 17047->17048 17048->16965 17049 7ff61de5e053 17051 7ff61de5a514 __std_exception_copy 37 API calls 17049->17051 17050->17049 17052 7ff61de54830 45 API calls 17050->17052 17055 7ff61de5e095 memcpy_s 17051->17055 17052->17049 17053 7ff61de5a970 _isindst 17 API calls 17054 7ff61de5e140 17053->17054 17055->17053 17057 7ff61de50ccf 17056->17057 17063 7ff61de50cbe 17056->17063 17058 7ff61de5d66c _fread_nolock 12 API calls 17057->17058 17057->17063 17059 7ff61de50d00 17058->17059 17060 7ff61de50d14 17059->17060 17061 7ff61de5a9b8 __free_lconv_num 11 API calls 17059->17061 17062 7ff61de5a9b8 __free_lconv_num 11 API calls 17060->17062 17061->17060 17062->17063 17063->16873 17065 7ff61de547d6 17064->17065 17067 7ff61de547de 17064->17067 17066 7ff61de54830 45 API calls 17065->17066 17066->17067 17067->16884 17069 7ff61de5486f 17068->17069 17070 7ff61de5da41 17068->17070 17072 7ff61de5da94 17069->17072 17070->17069 17076 7ff61de63374 17070->17076 17073 7ff61de5daad 17072->17073 17074 7ff61de5487f 17072->17074 17073->17074 17111 7ff61de626c0 17073->17111 17074->16806 17088 7ff61de5b1c0 GetLastError 17076->17088 17079 7ff61de633ce 17079->17069 17089 7ff61de5b1e4 FlsGetValue 17088->17089 17090 7ff61de5b201 FlsSetValue 17088->17090 17091 7ff61de5b1fb 17089->17091 17108 7ff61de5b1f1 17089->17108 17092 7ff61de5b213 17090->17092 17090->17108 17091->17090 17094 7ff61de5ec08 _get_daylight 11 API calls 17092->17094 17093 7ff61de5b26d SetLastError 17095 7ff61de5b27a 17093->17095 17096 7ff61de5b28d 17093->17096 17097 7ff61de5b222 17094->17097 17095->17079 17110 7ff61de60348 EnterCriticalSection 17095->17110 17098 7ff61de5a574 _CreateFrameInfo 38 API calls 17096->17098 17099 7ff61de5b240 FlsSetValue 17097->17099 17100 7ff61de5b230 FlsSetValue 17097->17100 17101 7ff61de5b292 17098->17101 17103 7ff61de5b24c FlsSetValue 17099->17103 17104 7ff61de5b25e 17099->17104 17102 7ff61de5b239 17100->17102 17106 7ff61de5a9b8 __free_lconv_num 11 API calls 17102->17106 17103->17102 17105 7ff61de5af64 _get_daylight 11 API calls 17104->17105 17107 7ff61de5b266 17105->17107 17106->17108 17109 7ff61de5a9b8 __free_lconv_num 11 API calls 17107->17109 17108->17093 17109->17093 17112 7ff61de5b1c0 _CreateFrameInfo 45 API calls 17111->17112 17113 7ff61de626c9 17112->17113 17120 7ff61de66df8 17114->17120 17119 7ff61de5f919 MultiByteToWideChar 17117->17119 17123 7ff61de66e5c 17120->17123 17121 7ff61de4c5c0 _log10_special 8 API calls 17122 7ff61de6012d 17121->17122 17122->16900 17123->17121 17125 7ff61de5106d 17124->17125 17126 7ff61de5107f 17124->17126 17127 7ff61de54f78 _get_daylight 11 API calls 17125->17127 17128 7ff61de5108d 17126->17128 17132 7ff61de510c9 17126->17132 17129 7ff61de51072 17127->17129 17130 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17128->17130 17131 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17129->17131 17138 7ff61de5107d 17130->17138 17131->17138 17133 7ff61de51445 17132->17133 17135 7ff61de54f78 _get_daylight 11 API calls 17132->17135 17134 7ff61de54f78 _get_daylight 11 API calls 17133->17134 17133->17138 17136 7ff61de516d9 17134->17136 17137 7ff61de5143a 17135->17137 17139 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17136->17139 17140 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17137->17140 17138->16771 17139->17138 17140->17133 17142 7ff61de50774 17141->17142 17169 7ff61de504d4 17142->17169 17144 7ff61de5078d 17144->16306 17181 7ff61de5042c 17145->17181 17149 7ff61de4c8c0 17148->17149 17150 7ff61de42930 GetCurrentProcessId 17149->17150 17151 7ff61de41c80 49 API calls 17150->17151 17152 7ff61de42979 17151->17152 17195 7ff61de549f4 17152->17195 17157 7ff61de41c80 49 API calls 17158 7ff61de429ff 17157->17158 17225 7ff61de42620 17158->17225 17161 7ff61de4c5c0 _log10_special 8 API calls 17162 7ff61de42a31 17161->17162 17162->16345 17164 7ff61de41b89 17163->17164 17165 7ff61de50189 17163->17165 17164->16344 17164->16345 17166 7ff61de54f78 _get_daylight 11 API calls 17165->17166 17167 7ff61de5018e 17166->17167 17168 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17167->17168 17168->17164 17170 7ff61de5053e 17169->17170 17171 7ff61de504fe 17169->17171 17170->17171 17173 7ff61de5054a 17170->17173 17172 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17171->17172 17175 7ff61de50525 17172->17175 17180 7ff61de554dc EnterCriticalSection 17173->17180 17175->17144 17182 7ff61de50456 17181->17182 17193 7ff61de41a20 17181->17193 17183 7ff61de504a2 17182->17183 17184 7ff61de50465 memcpy_s 17182->17184 17182->17193 17194 7ff61de554dc EnterCriticalSection 17183->17194 17186 7ff61de54f78 _get_daylight 11 API calls 17184->17186 17188 7ff61de5047a 17186->17188 17190 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17188->17190 17190->17193 17193->16314 17193->16315 17198 7ff61de54a4e 17195->17198 17196 7ff61de54a73 17197 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17196->17197 17201 7ff61de54a9d 17197->17201 17198->17196 17199 7ff61de54aaf 17198->17199 17234 7ff61de52c80 17199->17234 17203 7ff61de4c5c0 _log10_special 8 API calls 17201->17203 17202 7ff61de54b8c 17204 7ff61de5a9b8 __free_lconv_num 11 API calls 17202->17204 17206 7ff61de429c3 17203->17206 17204->17201 17213 7ff61de551d0 17206->17213 17207 7ff61de54bb0 17207->17202 17209 7ff61de54bba 17207->17209 17208 7ff61de54b61 17210 7ff61de5a9b8 __free_lconv_num 11 API calls 17208->17210 17212 7ff61de5a9b8 __free_lconv_num 11 API calls 17209->17212 17210->17201 17211 7ff61de54b58 17211->17202 17211->17208 17212->17201 17214 7ff61de5b338 _get_daylight 11 API calls 17213->17214 17215 7ff61de551e7 17214->17215 17216 7ff61de429e5 17215->17216 17217 7ff61de5ec08 _get_daylight 11 API calls 17215->17217 17220 7ff61de55227 17215->17220 17216->17157 17218 7ff61de5521c 17217->17218 17219 7ff61de5a9b8 __free_lconv_num 11 API calls 17218->17219 17219->17220 17220->17216 17372 7ff61de5ec90 17220->17372 17223 7ff61de5a970 _isindst 17 API calls 17224 7ff61de5526c 17223->17224 17226 7ff61de4262f 17225->17226 17227 7ff61de49400 2 API calls 17226->17227 17228 7ff61de42660 17227->17228 17229 7ff61de4266f MessageBoxW 17228->17229 17230 7ff61de42683 MessageBoxA 17228->17230 17231 7ff61de42690 17229->17231 17230->17231 17232 7ff61de4c5c0 _log10_special 8 API calls 17231->17232 17233 7ff61de426a0 17232->17233 17233->17161 17235 7ff61de52cbe 17234->17235 17236 7ff61de52cae 17234->17236 17237 7ff61de52cc7 17235->17237 17244 7ff61de52cf5 17235->17244 17240 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17236->17240 17238 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17237->17238 17239 7ff61de52ced 17238->17239 17239->17202 17239->17207 17239->17208 17239->17211 17240->17239 17241 7ff61de54830 45 API calls 17241->17244 17243 7ff61de52fa4 17246 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17243->17246 17244->17236 17244->17239 17244->17241 17244->17243 17248 7ff61de53610 17244->17248 17274 7ff61de532d8 17244->17274 17304 7ff61de52b60 17244->17304 17246->17236 17249 7ff61de53652 17248->17249 17250 7ff61de536c5 17248->17250 17251 7ff61de53658 17249->17251 17252 7ff61de536ef 17249->17252 17253 7ff61de536ca 17250->17253 17254 7ff61de5371f 17250->17254 17259 7ff61de5365d 17251->17259 17262 7ff61de5372e 17251->17262 17321 7ff61de51bc0 17252->17321 17255 7ff61de536cc 17253->17255 17256 7ff61de536ff 17253->17256 17254->17252 17254->17262 17272 7ff61de53688 17254->17272 17261 7ff61de536db 17255->17261 17268 7ff61de5366d 17255->17268 17328 7ff61de517b0 17256->17328 17263 7ff61de536a0 17259->17263 17259->17268 17259->17272 17261->17252 17265 7ff61de536e0 17261->17265 17273 7ff61de5375d 17262->17273 17335 7ff61de51fd0 17262->17335 17263->17273 17317 7ff61de54430 17263->17317 17269 7ff61de545c8 37 API calls 17265->17269 17265->17273 17267 7ff61de4c5c0 _log10_special 8 API calls 17270 7ff61de539f3 17267->17270 17268->17273 17307 7ff61de53f74 17268->17307 17269->17272 17270->17244 17272->17273 17342 7ff61de5e8c8 17272->17342 17273->17267 17275 7ff61de532f9 17274->17275 17276 7ff61de532e3 17274->17276 17279 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17275->17279 17286 7ff61de53337 17275->17286 17277 7ff61de53652 17276->17277 17278 7ff61de536c5 17276->17278 17276->17286 17280 7ff61de53658 17277->17280 17281 7ff61de536ef 17277->17281 17282 7ff61de536ca 17278->17282 17283 7ff61de5371f 17278->17283 17279->17286 17291 7ff61de5365d 17280->17291 17294 7ff61de5372e 17280->17294 17287 7ff61de51bc0 38 API calls 17281->17287 17284 7ff61de536cc 17282->17284 17285 7ff61de536ff 17282->17285 17283->17281 17283->17294 17303 7ff61de53688 17283->17303 17288 7ff61de5366d 17284->17288 17292 7ff61de536db 17284->17292 17289 7ff61de517b0 38 API calls 17285->17289 17286->17244 17287->17303 17290 7ff61de53f74 47 API calls 17288->17290 17301 7ff61de5375d 17288->17301 17289->17303 17290->17303 17291->17288 17293 7ff61de536a0 17291->17293 17291->17303 17292->17281 17296 7ff61de536e0 17292->17296 17297 7ff61de54430 47 API calls 17293->17297 17293->17301 17295 7ff61de51fd0 38 API calls 17294->17295 17294->17301 17295->17303 17299 7ff61de545c8 37 API calls 17296->17299 17296->17301 17297->17303 17298 7ff61de4c5c0 _log10_special 8 API calls 17300 7ff61de539f3 17298->17300 17299->17303 17300->17244 17301->17298 17302 7ff61de5e8c8 47 API calls 17302->17303 17303->17301 17303->17302 17355 7ff61de50d84 17304->17355 17308 7ff61de53f96 17307->17308 17309 7ff61de50bf0 12 API calls 17308->17309 17310 7ff61de53fde 17309->17310 17311 7ff61de5e5e0 46 API calls 17310->17311 17312 7ff61de540b1 17311->17312 17313 7ff61de54830 45 API calls 17312->17313 17316 7ff61de540d3 17312->17316 17313->17316 17314 7ff61de5415c 17314->17272 17314->17314 17315 7ff61de54830 45 API calls 17315->17314 17316->17314 17316->17315 17316->17316 17318 7ff61de54448 17317->17318 17320 7ff61de544b0 17317->17320 17319 7ff61de5e8c8 47 API calls 17318->17319 17318->17320 17319->17320 17320->17272 17322 7ff61de51bf3 17321->17322 17323 7ff61de51c22 17322->17323 17325 7ff61de51cdf 17322->17325 17324 7ff61de50bf0 12 API calls 17323->17324 17327 7ff61de51c5f 17323->17327 17324->17327 17326 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17325->17326 17326->17327 17327->17272 17329 7ff61de517e3 17328->17329 17330 7ff61de51812 17329->17330 17332 7ff61de518cf 17329->17332 17331 7ff61de50bf0 12 API calls 17330->17331 17334 7ff61de5184f 17330->17334 17331->17334 17333 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17332->17333 17333->17334 17334->17272 17336 7ff61de52003 17335->17336 17337 7ff61de52032 17336->17337 17339 7ff61de520ef 17336->17339 17338 7ff61de50bf0 12 API calls 17337->17338 17341 7ff61de5206f 17337->17341 17338->17341 17340 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17339->17340 17340->17341 17341->17272 17344 7ff61de5e8f0 17342->17344 17343 7ff61de5e935 17346 7ff61de5e8f5 memcpy_s 17343->17346 17348 7ff61de5e91e memcpy_s 17343->17348 17352 7ff61de60858 17343->17352 17344->17343 17345 7ff61de54830 45 API calls 17344->17345 17344->17346 17344->17348 17345->17343 17346->17272 17347 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17347->17346 17348->17346 17348->17347 17354 7ff61de6087c WideCharToMultiByte 17352->17354 17356 7ff61de50dc3 17355->17356 17357 7ff61de50db1 17355->17357 17360 7ff61de50dd0 17356->17360 17363 7ff61de50e0d 17356->17363 17358 7ff61de54f78 _get_daylight 11 API calls 17357->17358 17359 7ff61de50db6 17358->17359 17361 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17359->17361 17362 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17360->17362 17368 7ff61de50dc1 17361->17368 17362->17368 17364 7ff61de50eb6 17363->17364 17366 7ff61de54f78 _get_daylight 11 API calls 17363->17366 17365 7ff61de54f78 _get_daylight 11 API calls 17364->17365 17364->17368 17367 7ff61de50f60 17365->17367 17369 7ff61de50eab 17366->17369 17371 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17367->17371 17368->17244 17370 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17369->17370 17370->17364 17371->17368 17377 7ff61de5ecad 17372->17377 17373 7ff61de5ecb2 17374 7ff61de5524d 17373->17374 17375 7ff61de54f78 _get_daylight 11 API calls 17373->17375 17374->17216 17374->17223 17376 7ff61de5ecbc 17375->17376 17378 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17376->17378 17377->17373 17377->17374 17379 7ff61de5ecfc 17377->17379 17378->17374 17379->17374 17380 7ff61de54f78 _get_daylight 11 API calls 17379->17380 17380->17376 17382 7ff61de48823 __std_exception_destroy 17381->17382 17383 7ff61de487a1 GetTokenInformation 17381->17383 17386 7ff61de4883c 17382->17386 17387 7ff61de48836 CloseHandle 17382->17387 17384 7ff61de487c2 GetLastError 17383->17384 17385 7ff61de487cd 17383->17385 17384->17382 17384->17385 17385->17382 17388 7ff61de487e9 GetTokenInformation 17385->17388 17386->16363 17387->17386 17388->17382 17389 7ff61de4880c 17388->17389 17389->17382 17390 7ff61de48816 ConvertSidToStringSidW 17389->17390 17390->17382 17392 7ff61de4c8c0 17391->17392 17393 7ff61de42b74 GetCurrentProcessId 17392->17393 17394 7ff61de426b0 48 API calls 17393->17394 17395 7ff61de42bc7 17394->17395 17396 7ff61de54c48 48 API calls 17395->17396 17397 7ff61de42c10 MessageBoxW 17396->17397 17398 7ff61de4c5c0 _log10_special 8 API calls 17397->17398 17399 7ff61de42c40 17398->17399 17399->16374 17401 7ff61de425e5 17400->17401 17402 7ff61de54c48 48 API calls 17401->17402 17403 7ff61de42604 17402->17403 17403->16392 17449 7ff61de58804 17404->17449 17408 7ff61de481cc 17407->17408 17409 7ff61de49400 2 API calls 17408->17409 17410 7ff61de481eb 17409->17410 17411 7ff61de48206 ExpandEnvironmentStringsW 17410->17411 17412 7ff61de481f3 17410->17412 17414 7ff61de4822c __std_exception_destroy 17411->17414 17413 7ff61de42810 49 API calls 17412->17413 17438 7ff61de481ff __std_exception_destroy 17413->17438 17415 7ff61de48243 17414->17415 17416 7ff61de48230 17414->17416 17420 7ff61de482af 17415->17420 17421 7ff61de48251 GetDriveTypeW 17415->17421 17417 7ff61de42810 49 API calls 17416->17417 17417->17438 17418 7ff61de4c5c0 _log10_special 8 API calls 17419 7ff61de4839f 17418->17419 17419->16391 17439 7ff61de582a8 17419->17439 17587 7ff61de57e78 17420->17587 17424 7ff61de48285 17421->17424 17425 7ff61de482a0 17421->17425 17427 7ff61de42810 49 API calls 17424->17427 17580 7ff61de579dc 17425->17580 17426 7ff61de482c1 17429 7ff61de482c9 17426->17429 17432 7ff61de482dc 17426->17432 17427->17438 17430 7ff61de42810 49 API calls 17429->17430 17430->17438 17431 7ff61de4833e CreateDirectoryW 17434 7ff61de4834d GetLastError 17431->17434 17431->17438 17432->17431 17433 7ff61de426b0 48 API calls 17432->17433 17435 7ff61de48318 CreateDirectoryW 17433->17435 17434->17438 17435->17432 17438->17418 17440 7ff61de582c8 17439->17440 17441 7ff61de582b5 17439->17441 17688 7ff61de57f2c 17440->17688 17443 7ff61de54f78 _get_daylight 11 API calls 17441->17443 17444 7ff61de582ba 17443->17444 17446 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17444->17446 17447 7ff61de582c6 17446->17447 17447->16389 17490 7ff61de615c8 17449->17490 17549 7ff61de61340 17490->17549 17570 7ff61de60348 EnterCriticalSection 17549->17570 17581 7ff61de57a2d 17580->17581 17582 7ff61de579fa 17580->17582 17581->17438 17582->17581 17599 7ff61de604e4 17582->17599 17585 7ff61de5a970 _isindst 17 API calls 17586 7ff61de57a5d 17585->17586 17588 7ff61de57f02 17587->17588 17589 7ff61de57e94 17587->17589 17633 7ff61de60830 17588->17633 17589->17588 17590 7ff61de57e99 17589->17590 17592 7ff61de57ece 17590->17592 17593 7ff61de57eb1 17590->17593 17616 7ff61de57cbc GetFullPathNameW 17592->17616 17608 7ff61de57c48 GetFullPathNameW 17593->17608 17598 7ff61de57ec6 __std_exception_destroy 17598->17426 17600 7ff61de604f1 17599->17600 17602 7ff61de604fb 17599->17602 17600->17602 17606 7ff61de60517 17600->17606 17601 7ff61de54f78 _get_daylight 11 API calls 17603 7ff61de60503 17601->17603 17602->17601 17605 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17603->17605 17604 7ff61de57a29 17604->17581 17604->17585 17605->17604 17606->17604 17607 7ff61de54f78 _get_daylight 11 API calls 17606->17607 17607->17603 17609 7ff61de57c6e GetLastError 17608->17609 17610 7ff61de57c84 17608->17610 17611 7ff61de54eec _fread_nolock 11 API calls 17609->17611 17612 7ff61de57c80 17610->17612 17614 7ff61de54f78 _get_daylight 11 API calls 17610->17614 17613 7ff61de57c7b 17611->17613 17612->17598 17615 7ff61de54f78 _get_daylight 11 API calls 17613->17615 17614->17612 17615->17612 17617 7ff61de57cef GetLastError 17616->17617 17622 7ff61de57d05 __std_exception_destroy 17616->17622 17618 7ff61de54eec _fread_nolock 11 API calls 17617->17618 17619 7ff61de57cfc 17618->17619 17621 7ff61de54f78 _get_daylight 11 API calls 17619->17621 17620 7ff61de57d01 17624 7ff61de57d94 17620->17624 17621->17620 17622->17620 17623 7ff61de57d5f GetFullPathNameW 17622->17623 17623->17617 17623->17620 17625 7ff61de57dbd memcpy_s 17624->17625 17628 7ff61de57e08 memcpy_s 17624->17628 17626 7ff61de57df1 17625->17626 17625->17628 17630 7ff61de57e2a 17625->17630 17627 7ff61de54f78 _get_daylight 11 API calls 17626->17627 17629 7ff61de57df6 17627->17629 17628->17598 17630->17628 17632 7ff61de54f78 _get_daylight 11 API calls 17630->17632 17632->17629 17636 7ff61de60640 17633->17636 17637 7ff61de6066b 17636->17637 17638 7ff61de60682 17636->17638 17641 7ff61de54f78 _get_daylight 11 API calls 17637->17641 17639 7ff61de606a7 17638->17639 17640 7ff61de60686 17638->17640 17674 7ff61de5f628 17639->17674 17662 7ff61de607ac 17640->17662 17644 7ff61de60670 17641->17644 17648 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17644->17648 17646 7ff61de606ac 17651 7ff61de60751 17646->17651 17657 7ff61de606d3 17646->17657 17647 7ff61de6068f 17649 7ff61de54f58 _fread_nolock 11 API calls 17647->17649 17661 7ff61de6067b __std_exception_destroy 17648->17661 17651->17637 17653 7ff61de4c5c0 _log10_special 8 API calls 17656 7ff61de607a1 17653->17656 17656->17598 17661->17653 17663 7ff61de607f6 17662->17663 17664 7ff61de607c6 17662->17664 17665 7ff61de60801 GetDriveTypeW 17663->17665 17667 7ff61de607e1 17663->17667 17666 7ff61de54f58 _fread_nolock 11 API calls 17664->17666 17665->17667 17668 7ff61de607cb 17666->17668 17669 7ff61de4c5c0 _log10_special 8 API calls 17667->17669 17670 7ff61de54f78 _get_daylight 11 API calls 17668->17670 17671 7ff61de6068b 17669->17671 17672 7ff61de607d6 17670->17672 17671->17646 17671->17647 17673 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17672->17673 17673->17667 17675 7ff61de6a540 memcpy_s 17674->17675 17676 7ff61de5f65e GetCurrentDirectoryW 17675->17676 17677 7ff61de5f69c 17676->17677 17678 7ff61de5f675 17676->17678 17679 7ff61de5ec08 _get_daylight 11 API calls 17677->17679 17680 7ff61de4c5c0 _log10_special 8 API calls 17678->17680 17681 7ff61de5f6ab 17679->17681 17682 7ff61de5f709 17680->17682 17682->17646 17695 7ff61de60348 EnterCriticalSection 17688->17695 17697 7ff61de4455a 17696->17697 17698 7ff61de49400 2 API calls 17697->17698 17699 7ff61de4457f 17698->17699 17700 7ff61de4c5c0 _log10_special 8 API calls 17699->17700 17701 7ff61de445a7 17700->17701 17701->16420 17704 7ff61de47e1e 17702->17704 17703 7ff61de47f42 17706 7ff61de4c5c0 _log10_special 8 API calls 17703->17706 17704->17703 17705 7ff61de41c80 49 API calls 17704->17705 17709 7ff61de47ea5 17705->17709 17707 7ff61de47f73 17706->17707 17707->16420 17708 7ff61de41c80 49 API calls 17708->17709 17709->17703 17709->17708 17710 7ff61de44550 10 API calls 17709->17710 17711 7ff61de49400 2 API calls 17709->17711 17710->17709 17712 7ff61de47f13 CreateDirectoryW 17711->17712 17712->17703 17712->17709 17714 7ff61de41637 17713->17714 17715 7ff61de41613 17713->17715 17717 7ff61de445b0 108 API calls 17714->17717 17834 7ff61de41050 17715->17834 17719 7ff61de4164b 17717->17719 17718 7ff61de41618 17720 7ff61de4162e 17718->17720 17724 7ff61de42710 54 API calls 17718->17724 17721 7ff61de41653 17719->17721 17722 7ff61de41682 17719->17722 17720->16420 17725 7ff61de54f78 _get_daylight 11 API calls 17721->17725 17723 7ff61de445b0 108 API calls 17722->17723 17727 7ff61de41696 17723->17727 17724->17720 17726 7ff61de41658 17725->17726 17728 7ff61de42910 54 API calls 17726->17728 17729 7ff61de416b8 17727->17729 17730 7ff61de4169e 17727->17730 17731 7ff61de41671 17728->17731 17733 7ff61de50744 73 API calls 17729->17733 17732 7ff61de42710 54 API calls 17730->17732 17731->16420 17734 7ff61de416ae 17732->17734 17735 7ff61de416cd 17733->17735 17740 7ff61de500bc 74 API calls 17734->17740 17736 7ff61de416f9 17735->17736 17737 7ff61de416d1 17735->17737 17738 7ff61de41717 17736->17738 17739 7ff61de416ff 17736->17739 17741 7ff61de54f78 _get_daylight 11 API calls 17737->17741 17746 7ff61de41739 17738->17746 17756 7ff61de41761 17738->17756 17812 7ff61de41210 17739->17812 17743 7ff61de41829 17740->17743 17744 7ff61de416d6 17741->17744 17743->16420 17745 7ff61de42910 54 API calls 17744->17745 17752 7ff61de416ef __std_exception_destroy 17745->17752 17748 7ff61de54f78 _get_daylight 11 API calls 17746->17748 17747 7ff61de500bc 74 API calls 17747->17734 17749 7ff61de4173e 17748->17749 17751 7ff61de42910 54 API calls 17749->17751 17750 7ff61de5040c _fread_nolock 53 API calls 17750->17756 17751->17752 17752->17747 17753 7ff61de417da 17755 7ff61de54f78 _get_daylight 11 API calls 17753->17755 17757 7ff61de417ca 17755->17757 17756->17750 17756->17752 17756->17753 17758 7ff61de417c5 17756->17758 17865 7ff61de50b4c 17756->17865 17760 7ff61de42910 54 API calls 17757->17760 17759 7ff61de54f78 _get_daylight 11 API calls 17758->17759 17759->17757 17760->17752 17762 7ff61de4717b 17761->17762 17764 7ff61de47134 17761->17764 17762->16420 17764->17762 17898 7ff61de55094 17764->17898 17766 7ff61de44191 17765->17766 17767 7ff61de444d0 49 API calls 17766->17767 17768 7ff61de441cb 17767->17768 17769 7ff61de444d0 49 API calls 17768->17769 17770 7ff61de441db 17769->17770 17771 7ff61de441fd 17770->17771 17772 7ff61de4422c 17770->17772 17929 7ff61de44100 17771->17929 17773 7ff61de44100 51 API calls 17772->17773 17775 7ff61de4422a 17773->17775 17776 7ff61de44257 17775->17776 17777 7ff61de4428c 17775->17777 17936 7ff61de47ce0 17776->17936 17779 7ff61de44100 51 API calls 17777->17779 17781 7ff61de442b0 17779->17781 17784 7ff61de44100 51 API calls 17781->17784 17790 7ff61de44302 17781->17790 17782 7ff61de44383 17785 7ff61de41950 115 API calls 17782->17785 17783 7ff61de42710 54 API calls 17787 7ff61de44287 17783->17787 17788 7ff61de442d9 17784->17788 17789 7ff61de4438d 17785->17789 17786 7ff61de4c5c0 _log10_special 8 API calls 17791 7ff61de44425 17786->17791 17787->17786 17788->17790 17794 7ff61de44100 51 API calls 17788->17794 17792 7ff61de443ee 17789->17792 17793 7ff61de44395 17789->17793 17790->17782 17796 7ff61de4437c 17790->17796 17798 7ff61de44307 17790->17798 17800 7ff61de4436b 17790->17800 17791->16420 17795 7ff61de42710 54 API calls 17792->17795 17962 7ff61de41840 17793->17962 17794->17790 17795->17798 17796->17793 17796->17798 17801 7ff61de42710 54 API calls 17798->17801 17804 7ff61de42710 54 API calls 17800->17804 17801->17787 17802 7ff61de443ac 17805 7ff61de42710 54 API calls 17802->17805 17803 7ff61de443c2 17806 7ff61de41600 118 API calls 17803->17806 17804->17798 17805->17787 17807 7ff61de443d0 17806->17807 17807->17787 17808 7ff61de42710 54 API calls 17807->17808 17808->17787 17810 7ff61de41c80 49 API calls 17809->17810 17811 7ff61de44464 17810->17811 17811->16420 17813 7ff61de41268 17812->17813 17814 7ff61de41297 17813->17814 17815 7ff61de4126f 17813->17815 17818 7ff61de412b1 17814->17818 17819 7ff61de412d4 17814->17819 17816 7ff61de42710 54 API calls 17815->17816 17817 7ff61de41282 17816->17817 17817->17752 17820 7ff61de54f78 _get_daylight 11 API calls 17818->17820 17823 7ff61de412e6 17819->17823 17832 7ff61de41309 memcpy_s 17819->17832 17821 7ff61de412b6 17820->17821 17822 7ff61de42910 54 API calls 17821->17822 17828 7ff61de412cf __std_exception_destroy 17822->17828 17824 7ff61de54f78 _get_daylight 11 API calls 17823->17824 17826 7ff61de412eb 17824->17826 17825 7ff61de5040c _fread_nolock 53 API calls 17825->17832 17827 7ff61de42910 54 API calls 17826->17827 17827->17828 17828->17752 17829 7ff61de413cf 17830 7ff61de42710 54 API calls 17829->17830 17830->17828 17831 7ff61de50b4c 76 API calls 17831->17832 17832->17825 17832->17828 17832->17829 17832->17831 17833 7ff61de50180 37 API calls 17832->17833 17833->17832 17835 7ff61de445b0 108 API calls 17834->17835 17836 7ff61de4108c 17835->17836 17837 7ff61de410a9 17836->17837 17838 7ff61de41094 17836->17838 17839 7ff61de50744 73 API calls 17837->17839 17840 7ff61de42710 54 API calls 17838->17840 17841 7ff61de410bf 17839->17841 17843 7ff61de410a4 __std_exception_destroy 17840->17843 17842 7ff61de410c3 17841->17842 17845 7ff61de410e6 17841->17845 17844 7ff61de54f78 _get_daylight 11 API calls 17842->17844 17843->17718 17846 7ff61de410c8 17844->17846 17848 7ff61de410f7 17845->17848 17849 7ff61de41122 17845->17849 17847 7ff61de42910 54 API calls 17846->17847 17855 7ff61de410e1 __std_exception_destroy 17847->17855 17851 7ff61de54f78 _get_daylight 11 API calls 17848->17851 17850 7ff61de41129 17849->17850 17859 7ff61de4113c 17849->17859 17852 7ff61de41210 92 API calls 17850->17852 17853 7ff61de41100 17851->17853 17852->17855 17856 7ff61de42910 54 API calls 17853->17856 17854 7ff61de500bc 74 API calls 17857 7ff61de411b4 17854->17857 17855->17854 17856->17855 17857->17843 17869 7ff61de446e0 17857->17869 17858 7ff61de5040c _fread_nolock 53 API calls 17858->17859 17859->17855 17859->17858 17861 7ff61de411ed 17859->17861 17862 7ff61de54f78 _get_daylight 11 API calls 17861->17862 17863 7ff61de411f2 17862->17863 17864 7ff61de42910 54 API calls 17863->17864 17864->17855 17866 7ff61de50b7c 17865->17866 17883 7ff61de5089c 17866->17883 17868 7ff61de50b9a 17868->17756 17870 7ff61de446f0 17869->17870 17871 7ff61de49400 2 API calls 17870->17871 17872 7ff61de4471b 17871->17872 17873 7ff61de4478e 17872->17873 17874 7ff61de49400 2 API calls 17872->17874 17876 7ff61de4c5c0 _log10_special 8 API calls 17873->17876 17875 7ff61de44736 17874->17875 17875->17873 17877 7ff61de4473b CreateSymbolicLinkW 17875->17877 17878 7ff61de447a9 17876->17878 17877->17873 17879 7ff61de44765 17877->17879 17878->17843 17879->17873 17880 7ff61de4476e GetLastError 17879->17880 17880->17873 17884 7ff61de508bc 17883->17884 17889 7ff61de508e9 17883->17889 17885 7ff61de508c6 17884->17885 17886 7ff61de508f1 17884->17886 17884->17889 17887 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 17885->17887 17890 7ff61de507dc 17886->17890 17887->17889 17889->17868 17897 7ff61de554dc EnterCriticalSection 17890->17897 17899 7ff61de550ce 17898->17899 17900 7ff61de550a1 17898->17900 17902 7ff61de550f1 17899->17902 17906 7ff61de5510d 17899->17906 17901 7ff61de55058 17900->17901 17903 7ff61de54f78 _get_daylight 11 API calls 17900->17903 17901->17764 17905 7ff61de54f78 _get_daylight 11 API calls 17902->17905 17904 7ff61de550ab 17903->17904 17907 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17904->17907 17908 7ff61de550f6 17905->17908 17913 7ff61de54fbc 17906->17913 17910 7ff61de550b6 17907->17910 17911 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17908->17911 17910->17764 17912 7ff61de55101 17911->17912 17912->17764 17914 7ff61de54fe0 17913->17914 17920 7ff61de54fdb 17913->17920 17915 7ff61de5b1c0 _CreateFrameInfo 45 API calls 17914->17915 17914->17920 17916 7ff61de54ffb 17915->17916 17921 7ff61de5d9f4 17916->17921 17920->17912 17922 7ff61de5da09 17921->17922 17923 7ff61de5501e 17921->17923 17922->17923 17924 7ff61de63374 45 API calls 17922->17924 17925 7ff61de5da60 17923->17925 17924->17923 17926 7ff61de5da88 17925->17926 17927 7ff61de5da75 17925->17927 17926->17920 17927->17926 17928 7ff61de626c0 45 API calls 17927->17928 17928->17926 17930 7ff61de44126 17929->17930 17931 7ff61de549f4 49 API calls 17930->17931 17932 7ff61de4414c 17931->17932 17933 7ff61de4415d 17932->17933 17934 7ff61de44550 10 API calls 17932->17934 17933->17775 17935 7ff61de4416f 17934->17935 17935->17775 17937 7ff61de47cf5 17936->17937 17938 7ff61de445b0 108 API calls 17937->17938 17939 7ff61de47d1b 17938->17939 17940 7ff61de47d42 17939->17940 17941 7ff61de445b0 108 API calls 17939->17941 17942 7ff61de4c5c0 _log10_special 8 API calls 17940->17942 17943 7ff61de47d32 17941->17943 17944 7ff61de44267 17942->17944 17945 7ff61de47d3d 17943->17945 17946 7ff61de47d4c 17943->17946 17944->17783 17944->17787 17948 7ff61de500bc 74 API calls 17945->17948 17966 7ff61de50154 17946->17966 17948->17940 17949 7ff61de500bc 74 API calls 17951 7ff61de47dd7 17949->17951 17950 7ff61de5040c _fread_nolock 53 API calls 17952 7ff61de47d51 17950->17952 17952->17950 17954 7ff61de47db6 17952->17954 17956 7ff61de50b4c 76 API calls 17952->17956 17957 7ff61de47db1 17952->17957 17958 7ff61de50180 37 API calls 17952->17958 17960 7ff61de47daf 17952->17960 17961 7ff61de50154 37 API calls 17952->17961 17955 7ff61de50180 37 API calls 17954->17955 17955->17957 17956->17952 17957->17960 17972 7ff61de57388 17957->17972 17958->17952 17960->17949 17961->17952 17964 7ff61de418d5 17962->17964 17965 7ff61de41865 17962->17965 17963 7ff61de55094 45 API calls 17963->17965 17964->17802 17964->17803 17965->17963 17965->17964 17967 7ff61de5015d 17966->17967 17968 7ff61de5016d 17966->17968 17969 7ff61de54f78 _get_daylight 11 API calls 17967->17969 17968->17952 17970 7ff61de50162 17969->17970 17971 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17970->17971 17971->17968 17973 7ff61de57390 17972->17973 17993 7ff61de55f38 17992->17993 17994 7ff61de55f5e 17993->17994 17997 7ff61de55f91 17993->17997 17995 7ff61de54f78 _get_daylight 11 API calls 17994->17995 17996 7ff61de55f63 17995->17996 17998 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 17996->17998 17999 7ff61de55f97 17997->17999 18000 7ff61de55fa4 17997->18000 18010 7ff61de44606 17998->18010 18001 7ff61de54f78 _get_daylight 11 API calls 17999->18001 18011 7ff61de5ac98 18000->18011 18001->18010 18010->16451 18024 7ff61de60348 EnterCriticalSection 18011->18024 18384 7ff61de57968 18383->18384 18387 7ff61de57444 18384->18387 18386 7ff61de57981 18386->16461 18388 7ff61de5748e 18387->18388 18389 7ff61de5745f 18387->18389 18397 7ff61de554dc EnterCriticalSection 18388->18397 18391 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 18389->18391 18396 7ff61de5747f 18391->18396 18396->18386 18399 7ff61de4feb3 18398->18399 18400 7ff61de4fee1 18398->18400 18401 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 18399->18401 18403 7ff61de4fed3 18400->18403 18408 7ff61de554dc EnterCriticalSection 18400->18408 18401->18403 18403->16465 18410 7ff61de4cb62 RtlLookupFunctionEntry 18409->18410 18411 7ff61de4cb78 RtlVirtualUnwind 18410->18411 18412 7ff61de4c97b 18410->18412 18411->18410 18411->18412 18413 7ff61de4c910 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18412->18413 18415 7ff61de445b0 108 API calls 18414->18415 18416 7ff61de41493 18415->18416 18417 7ff61de414bc 18416->18417 18418 7ff61de4149b 18416->18418 18420 7ff61de50744 73 API calls 18417->18420 18419 7ff61de42710 54 API calls 18418->18419 18421 7ff61de414ab 18419->18421 18422 7ff61de414d1 18420->18422 18421->16507 18423 7ff61de414f8 18422->18423 18424 7ff61de414d5 18422->18424 18427 7ff61de41508 18423->18427 18428 7ff61de41532 18423->18428 18425 7ff61de54f78 _get_daylight 11 API calls 18424->18425 18426 7ff61de414da 18425->18426 18429 7ff61de42910 54 API calls 18426->18429 18430 7ff61de54f78 _get_daylight 11 API calls 18427->18430 18431 7ff61de41538 18428->18431 18439 7ff61de4154b 18428->18439 18436 7ff61de414f3 __std_exception_destroy 18429->18436 18432 7ff61de41510 18430->18432 18433 7ff61de41210 92 API calls 18431->18433 18434 7ff61de42910 54 API calls 18432->18434 18433->18436 18434->18436 18435 7ff61de500bc 74 API calls 18437 7ff61de415c4 18435->18437 18436->18435 18437->16507 18438 7ff61de5040c _fread_nolock 53 API calls 18438->18439 18439->18436 18439->18438 18440 7ff61de415d6 18439->18440 18441 7ff61de54f78 _get_daylight 11 API calls 18440->18441 18442 7ff61de415db 18441->18442 18443 7ff61de42910 54 API calls 18442->18443 18443->18436 18445 7ff61de49400 2 API calls 18444->18445 18446 7ff61de49084 LoadLibraryExW 18445->18446 18447 7ff61de490a3 __std_exception_destroy 18446->18447 18447->16541 18521 7ff61de46365 18520->18521 18522 7ff61de41c80 49 API calls 18521->18522 18523 7ff61de463a1 18522->18523 18524 7ff61de463cd 18523->18524 18525 7ff61de463aa 18523->18525 18527 7ff61de44620 49 API calls 18524->18527 18526 7ff61de42710 54 API calls 18525->18526 18543 7ff61de463c3 18526->18543 18528 7ff61de463e5 18527->18528 18529 7ff61de46403 18528->18529 18530 7ff61de42710 54 API calls 18528->18530 18531 7ff61de44550 10 API calls 18529->18531 18530->18529 18534 7ff61de4640d 18531->18534 18532 7ff61de4c5c0 _log10_special 8 API calls 18533 7ff61de4336e 18532->18533 18533->16581 18551 7ff61de464f0 18533->18551 18535 7ff61de4641b 18534->18535 18536 7ff61de49070 3 API calls 18534->18536 18537 7ff61de44620 49 API calls 18535->18537 18536->18535 18538 7ff61de46434 18537->18538 18539 7ff61de46459 18538->18539 18540 7ff61de46439 18538->18540 18542 7ff61de49070 3 API calls 18539->18542 18541 7ff61de42710 54 API calls 18540->18541 18541->18543 18544 7ff61de46466 18542->18544 18543->18532 18545 7ff61de464b1 18544->18545 18546 7ff61de46472 18544->18546 18610 7ff61de45820 GetProcAddress 18545->18610 18547 7ff61de49400 2 API calls 18546->18547 18549 7ff61de4648a GetLastError 18547->18549 18550 7ff61de42c50 51 API calls 18549->18550 18550->18543 18700 7ff61de453f0 18551->18700 18553 7ff61de46516 18554 7ff61de4652f 18553->18554 18555 7ff61de4651e 18553->18555 18707 7ff61de44c80 18554->18707 18556 7ff61de42710 54 API calls 18555->18556 18562 7ff61de4652a 18556->18562 18559 7ff61de4654c 18563 7ff61de4655c 18559->18563 18565 7ff61de4656d 18559->18565 18560 7ff61de4653b 18561 7ff61de42710 54 API calls 18560->18561 18561->18562 18562->16577 18564 7ff61de42710 54 API calls 18563->18564 18564->18562 18566 7ff61de4659d 18565->18566 18567 7ff61de4658c 18565->18567 18569 7ff61de465bd 18566->18569 18570 7ff61de465ac 18566->18570 18568 7ff61de42710 54 API calls 18567->18568 18568->18562 18711 7ff61de44d40 18569->18711 18571 7ff61de42710 54 API calls 18570->18571 18571->18562 18589 7ff61de46060 18588->18589 18589->18589 18590 7ff61de46089 18589->18590 18595 7ff61de460a0 __std_exception_destroy 18589->18595 18591 7ff61de42710 54 API calls 18590->18591 18592 7ff61de46095 18591->18592 18592->16579 18593 7ff61de461ab 18593->16579 18594 7ff61de41470 116 API calls 18594->18595 18595->18593 18595->18594 18596 7ff61de42710 54 API calls 18595->18596 18596->18595 18611 7ff61de4586f GetProcAddress 18610->18611 18612 7ff61de45842 GetLastError 18610->18612 18614 7ff61de4588b GetLastError 18611->18614 18615 7ff61de4589a GetProcAddress 18611->18615 18613 7ff61de4584f 18612->18613 18616 7ff61de42c50 51 API calls 18613->18616 18614->18613 18617 7ff61de458b6 GetLastError 18615->18617 18618 7ff61de458c5 GetProcAddress 18615->18618 18619 7ff61de45864 18616->18619 18617->18613 18620 7ff61de458e1 GetLastError 18618->18620 18621 7ff61de458f3 GetProcAddress 18618->18621 18619->18543 18620->18613 18622 7ff61de45921 GetProcAddress 18621->18622 18623 7ff61de4590f GetLastError 18621->18623 18623->18613 18701 7ff61de4541c 18700->18701 18702 7ff61de45424 18701->18702 18703 7ff61de455c4 18701->18703 18731 7ff61de56b14 18701->18731 18702->18553 18704 7ff61de45787 __std_exception_destroy 18703->18704 18705 7ff61de447c0 47 API calls 18703->18705 18704->18553 18705->18703 18708 7ff61de44cb0 18707->18708 18709 7ff61de4c5c0 _log10_special 8 API calls 18708->18709 18710 7ff61de44d1a 18709->18710 18710->18559 18710->18560 18732 7ff61de56b44 18731->18732 18735 7ff61de56010 18732->18735 18734 7ff61de56b74 18734->18701 18736 7ff61de56053 18735->18736 18737 7ff61de56041 18735->18737 18738 7ff61de5609d 18736->18738 18740 7ff61de56060 18736->18740 18739 7ff61de54f78 _get_daylight 11 API calls 18737->18739 18741 7ff61de560b8 18738->18741 18744 7ff61de54830 45 API calls 18738->18744 18742 7ff61de56046 18739->18742 18743 7ff61de5a884 _invalid_parameter_noinfo 37 API calls 18740->18743 18747 7ff61de560da 18741->18747 18756 7ff61de56a9c 18741->18756 18746 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18742->18746 18754 7ff61de56051 18743->18754 18744->18741 18746->18754 18748 7ff61de5617b 18747->18748 18749 7ff61de54f78 _get_daylight 11 API calls 18747->18749 18750 7ff61de54f78 _get_daylight 11 API calls 18748->18750 18748->18754 18752 7ff61de56170 18749->18752 18751 7ff61de56226 18750->18751 18753 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18751->18753 18755 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18752->18755 18753->18754 18754->18734 18755->18748 18757 7ff61de56abf 18756->18757 18759 7ff61de56ad6 18756->18759 18762 7ff61de5ffd8 18757->18762 18761 7ff61de56ac4 18759->18761 18767 7ff61de60008 18759->18767 18761->18741 18763 7ff61de5b1c0 _CreateFrameInfo 45 API calls 18762->18763 18764 7ff61de5ffe1 18763->18764 18765 7ff61de5d9f4 45 API calls 18764->18765 18768 7ff61de54fbc 45 API calls 18767->18768 18769 7ff61de60041 18768->18769 18808->16584 18810 7ff61de5b1c0 _CreateFrameInfo 45 API calls 18809->18810 18812 7ff61de5a451 18810->18812 18814 7ff61de5a574 18812->18814 18823 7ff61de636c0 18814->18823 18849 7ff61de63678 18823->18849 18854 7ff61de60348 EnterCriticalSection 18849->18854 18912 7ff61de55698 18913 7ff61de556b2 18912->18913 18914 7ff61de556cf 18912->18914 18915 7ff61de54f58 _fread_nolock 11 API calls 18913->18915 18914->18913 18916 7ff61de556e2 CreateFileW 18914->18916 18919 7ff61de556b7 18915->18919 18917 7ff61de5574c 18916->18917 18918 7ff61de55716 18916->18918 18963 7ff61de55c74 18917->18963 18937 7ff61de557ec GetFileType 18918->18937 18922 7ff61de54f78 _get_daylight 11 API calls 18919->18922 18925 7ff61de556bf 18922->18925 18930 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18925->18930 18926 7ff61de5572b CloseHandle 18931 7ff61de556ca 18926->18931 18927 7ff61de55741 CloseHandle 18927->18931 18928 7ff61de55755 18932 7ff61de54eec _fread_nolock 11 API calls 18928->18932 18929 7ff61de55780 18984 7ff61de55a34 18929->18984 18930->18931 18936 7ff61de5575f 18932->18936 18936->18931 18938 7ff61de5583a 18937->18938 18939 7ff61de558f7 18937->18939 18942 7ff61de55866 GetFileInformationByHandle 18938->18942 18943 7ff61de55b70 21 API calls 18938->18943 18940 7ff61de558ff 18939->18940 18941 7ff61de55921 18939->18941 18944 7ff61de55912 GetLastError 18940->18944 18945 7ff61de55903 18940->18945 18947 7ff61de55944 PeekNamedPipe 18941->18947 18962 7ff61de558e2 18941->18962 18942->18944 18946 7ff61de5588f 18942->18946 18948 7ff61de55854 18943->18948 18951 7ff61de54eec _fread_nolock 11 API calls 18944->18951 18949 7ff61de54f78 _get_daylight 11 API calls 18945->18949 18950 7ff61de55a34 51 API calls 18946->18950 18947->18962 18948->18942 18948->18962 18949->18962 18953 7ff61de5589a 18950->18953 18951->18962 18952 7ff61de4c5c0 _log10_special 8 API calls 18954 7ff61de55724 18952->18954 19001 7ff61de55994 18953->19001 18954->18926 18954->18927 18957 7ff61de55994 10 API calls 18958 7ff61de558b9 18957->18958 18959 7ff61de55994 10 API calls 18958->18959 18960 7ff61de558ca 18959->18960 18961 7ff61de54f78 _get_daylight 11 API calls 18960->18961 18960->18962 18961->18962 18962->18952 18964 7ff61de55caa 18963->18964 18965 7ff61de54f78 _get_daylight 11 API calls 18964->18965 18983 7ff61de55d42 __std_exception_destroy 18964->18983 18967 7ff61de55cbc 18965->18967 18966 7ff61de4c5c0 _log10_special 8 API calls 18968 7ff61de55751 18966->18968 18969 7ff61de54f78 _get_daylight 11 API calls 18967->18969 18968->18928 18968->18929 18970 7ff61de55cc4 18969->18970 18971 7ff61de57e78 45 API calls 18970->18971 18972 7ff61de55cd9 18971->18972 18973 7ff61de55ceb 18972->18973 18974 7ff61de55ce1 18972->18974 18975 7ff61de54f78 _get_daylight 11 API calls 18973->18975 18976 7ff61de54f78 _get_daylight 11 API calls 18974->18976 18977 7ff61de55cf0 18975->18977 18980 7ff61de55ce6 18976->18980 18978 7ff61de54f78 _get_daylight 11 API calls 18977->18978 18977->18983 18979 7ff61de55cfa 18978->18979 18981 7ff61de57e78 45 API calls 18979->18981 18982 7ff61de55d34 GetDriveTypeW 18980->18982 18980->18983 18981->18980 18982->18983 18983->18966 18985 7ff61de55a5c 18984->18985 18993 7ff61de5578d 18985->18993 19008 7ff61de5f794 18985->19008 18987 7ff61de55af0 18988 7ff61de5f794 51 API calls 18987->18988 18987->18993 18989 7ff61de55b03 18988->18989 18990 7ff61de5f794 51 API calls 18989->18990 18989->18993 18991 7ff61de55b16 18990->18991 18992 7ff61de5f794 51 API calls 18991->18992 18991->18993 18992->18993 18994 7ff61de55b70 18993->18994 18995 7ff61de55b8a 18994->18995 18996 7ff61de55bc1 18995->18996 18997 7ff61de55b9a 18995->18997 18998 7ff61de5f628 21 API calls 18996->18998 18999 7ff61de54eec _fread_nolock 11 API calls 18997->18999 19000 7ff61de55baa 18997->19000 18998->19000 18999->19000 19000->18936 19002 7ff61de559bd FileTimeToSystemTime 19001->19002 19003 7ff61de559b0 19001->19003 19004 7ff61de559d1 SystemTimeToTzSpecificLocalTime 19002->19004 19005 7ff61de559b8 19002->19005 19003->19002 19003->19005 19004->19005 19006 7ff61de4c5c0 _log10_special 8 API calls 19005->19006 19007 7ff61de558a9 19006->19007 19007->18957 19009 7ff61de5f7c5 19008->19009 19010 7ff61de5f7a1 19008->19010 19013 7ff61de5f7ff 19009->19013 19014 7ff61de5f81e 19009->19014 19010->19009 19011 7ff61de5f7a6 19010->19011 19012 7ff61de54f78 _get_daylight 11 API calls 19011->19012 19015 7ff61de5f7ab 19012->19015 19016 7ff61de54f78 _get_daylight 11 API calls 19013->19016 19017 7ff61de54fbc 45 API calls 19014->19017 19018 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 19015->19018 19019 7ff61de5f804 19016->19019 19024 7ff61de5f82b 19017->19024 19020 7ff61de5f7b6 19018->19020 19021 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 19019->19021 19020->18987 19022 7ff61de5f80f 19021->19022 19022->18987 19023 7ff61de6054c 51 API calls 19023->19024 19024->19022 19024->19023 19185 7ff61de61720 19196 7ff61de67454 19185->19196 19197 7ff61de67461 19196->19197 19198 7ff61de5a9b8 __free_lconv_num 11 API calls 19197->19198 19199 7ff61de6747d 19197->19199 19198->19197 19200 7ff61de5a9b8 __free_lconv_num 11 API calls 19199->19200 19201 7ff61de61729 19199->19201 19200->19199 19202 7ff61de60348 EnterCriticalSection 19201->19202 19744 7ff61de67c90 19747 7ff61de62660 19744->19747 19748 7ff61de6266d 19747->19748 19749 7ff61de626b2 19747->19749 19753 7ff61de5b294 19748->19753 19754 7ff61de5b2a5 FlsGetValue 19753->19754 19755 7ff61de5b2c0 FlsSetValue 19753->19755 19756 7ff61de5b2ba 19754->19756 19757 7ff61de5b2b2 19754->19757 19755->19757 19758 7ff61de5b2cd 19755->19758 19756->19755 19759 7ff61de5a574 _CreateFrameInfo 45 API calls 19757->19759 19761 7ff61de5b2b8 19757->19761 19760 7ff61de5ec08 _get_daylight 11 API calls 19758->19760 19762 7ff61de5b335 19759->19762 19763 7ff61de5b2dc 19760->19763 19773 7ff61de62334 19761->19773 19764 7ff61de5b2fa FlsSetValue 19763->19764 19765 7ff61de5b2ea FlsSetValue 19763->19765 19766 7ff61de5b306 FlsSetValue 19764->19766 19767 7ff61de5b318 19764->19767 19768 7ff61de5b2f3 19765->19768 19766->19768 19769 7ff61de5af64 _get_daylight 11 API calls 19767->19769 19770 7ff61de5a9b8 __free_lconv_num 11 API calls 19768->19770 19771 7ff61de5b320 19769->19771 19770->19757 19772 7ff61de5a9b8 __free_lconv_num 11 API calls 19771->19772 19772->19761 19796 7ff61de625a4 19773->19796 19775 7ff61de62369 19811 7ff61de62034 19775->19811 19778 7ff61de62386 19778->19749 19779 7ff61de5d66c _fread_nolock 12 API calls 19780 7ff61de62397 19779->19780 19781 7ff61de6239f 19780->19781 19783 7ff61de623ae 19780->19783 19782 7ff61de5a9b8 __free_lconv_num 11 API calls 19781->19782 19782->19778 19783->19783 19818 7ff61de626dc 19783->19818 19786 7ff61de624aa 19787 7ff61de54f78 _get_daylight 11 API calls 19786->19787 19789 7ff61de624af 19787->19789 19788 7ff61de62505 19792 7ff61de6256c 19788->19792 19829 7ff61de61e64 19788->19829 19790 7ff61de5a9b8 __free_lconv_num 11 API calls 19789->19790 19790->19778 19791 7ff61de624c4 19791->19788 19793 7ff61de5a9b8 __free_lconv_num 11 API calls 19791->19793 19795 7ff61de5a9b8 __free_lconv_num 11 API calls 19792->19795 19793->19788 19795->19778 19797 7ff61de625c7 19796->19797 19798 7ff61de625d1 19797->19798 19844 7ff61de60348 EnterCriticalSection 19797->19844 19800 7ff61de62643 19798->19800 19803 7ff61de5a574 _CreateFrameInfo 45 API calls 19798->19803 19800->19775 19805 7ff61de6265b 19803->19805 19807 7ff61de5b294 50 API calls 19805->19807 19810 7ff61de626b2 19805->19810 19808 7ff61de6269c 19807->19808 19809 7ff61de62334 65 API calls 19808->19809 19809->19810 19810->19775 19812 7ff61de54fbc 45 API calls 19811->19812 19813 7ff61de62048 19812->19813 19814 7ff61de62066 19813->19814 19815 7ff61de62054 GetOEMCP 19813->19815 19816 7ff61de6207b 19814->19816 19817 7ff61de6206b GetACP 19814->19817 19815->19816 19816->19778 19816->19779 19817->19816 19819 7ff61de62034 47 API calls 19818->19819 19820 7ff61de62709 19819->19820 19821 7ff61de6285f 19820->19821 19823 7ff61de62746 IsValidCodePage 19820->19823 19827 7ff61de62760 memcpy_s 19820->19827 19822 7ff61de4c5c0 _log10_special 8 API calls 19821->19822 19824 7ff61de624a1 19822->19824 19823->19821 19825 7ff61de62757 19823->19825 19824->19786 19824->19791 19826 7ff61de62786 GetCPInfo 19825->19826 19825->19827 19826->19821 19826->19827 19845 7ff61de6214c 19827->19845 19901 7ff61de60348 EnterCriticalSection 19829->19901 19846 7ff61de62189 GetCPInfo 19845->19846 19847 7ff61de6227f 19845->19847 19846->19847 19853 7ff61de6219c 19846->19853 19848 7ff61de4c5c0 _log10_special 8 API calls 19847->19848 19850 7ff61de6231e 19848->19850 19849 7ff61de62eb0 48 API calls 19851 7ff61de62213 19849->19851 19850->19821 19856 7ff61de67bf4 19851->19856 19853->19849 19855 7ff61de67bf4 54 API calls 19855->19847 19857 7ff61de54fbc 45 API calls 19856->19857 19858 7ff61de67c19 19857->19858 19861 7ff61de678c0 19858->19861 19862 7ff61de67901 19861->19862 19863 7ff61de5f910 _fread_nolock MultiByteToWideChar 19862->19863 19866 7ff61de6794b 19863->19866 19864 7ff61de67bc9 19865 7ff61de4c5c0 _log10_special 8 API calls 19864->19865 19867 7ff61de62246 19865->19867 19866->19864 19868 7ff61de5d66c _fread_nolock 12 API calls 19866->19868 19869 7ff61de67a81 19866->19869 19871 7ff61de67983 19866->19871 19867->19855 19868->19871 19869->19864 19870 7ff61de5a9b8 __free_lconv_num 11 API calls 19869->19870 19870->19864 19871->19869 19872 7ff61de5f910 _fread_nolock MultiByteToWideChar 19871->19872 19873 7ff61de679f6 19872->19873 19873->19869 19892 7ff61de5f154 19873->19892 19876 7ff61de67a92 19878 7ff61de5d66c _fread_nolock 12 API calls 19876->19878 19880 7ff61de67b64 19876->19880 19881 7ff61de67ab0 19876->19881 19877 7ff61de67a41 19877->19869 19879 7ff61de5f154 __crtLCMapStringW 6 API calls 19877->19879 19878->19881 19879->19869 19880->19869 19882 7ff61de5a9b8 __free_lconv_num 11 API calls 19880->19882 19881->19869 19883 7ff61de5f154 __crtLCMapStringW 6 API calls 19881->19883 19882->19869 19884 7ff61de67b30 19883->19884 19884->19880 19885 7ff61de67b66 19884->19885 19886 7ff61de67b50 19884->19886 19888 7ff61de60858 WideCharToMultiByte 19885->19888 19887 7ff61de60858 WideCharToMultiByte 19886->19887 19889 7ff61de67b5e 19887->19889 19888->19889 19889->19880 19890 7ff61de67b7e 19889->19890 19890->19869 19891 7ff61de5a9b8 __free_lconv_num 11 API calls 19890->19891 19891->19869 19893 7ff61de5ed80 __crtLCMapStringW 5 API calls 19892->19893 19894 7ff61de5f192 19893->19894 19896 7ff61de5f19a 19894->19896 19898 7ff61de5f240 19894->19898 19896->19869 19896->19876 19896->19877 19897 7ff61de5f203 LCMapStringW 19897->19896 19899 7ff61de5ed80 __crtLCMapStringW 5 API calls 19898->19899 19900 7ff61de5f26e __crtLCMapStringW 19899->19900 19900->19897 20299 7ff61de5c590 20310 7ff61de60348 EnterCriticalSection 20299->20310 18858 7ff61de5f9fc 18859 7ff61de5fbee 18858->18859 18861 7ff61de5fa3e _isindst 18858->18861 18860 7ff61de54f78 _get_daylight 11 API calls 18859->18860 18878 7ff61de5fbde 18860->18878 18861->18859 18864 7ff61de5fabe _isindst 18861->18864 18862 7ff61de4c5c0 _log10_special 8 API calls 18863 7ff61de5fc09 18862->18863 18879 7ff61de66204 18864->18879 18869 7ff61de5fc1a 18871 7ff61de5a970 _isindst 17 API calls 18869->18871 18873 7ff61de5fc2e 18871->18873 18876 7ff61de5fb1b 18876->18878 18903 7ff61de66248 18876->18903 18878->18862 18880 7ff61de66213 18879->18880 18881 7ff61de5fadc 18879->18881 18910 7ff61de60348 EnterCriticalSection 18880->18910 18885 7ff61de65608 18881->18885 18886 7ff61de5faf1 18885->18886 18887 7ff61de65611 18885->18887 18886->18869 18891 7ff61de65638 18886->18891 18888 7ff61de54f78 _get_daylight 11 API calls 18887->18888 18889 7ff61de65616 18888->18889 18890 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18889->18890 18890->18886 18892 7ff61de65641 18891->18892 18896 7ff61de5fb02 18891->18896 18893 7ff61de54f78 _get_daylight 11 API calls 18892->18893 18894 7ff61de65646 18893->18894 18895 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18894->18895 18895->18896 18896->18869 18897 7ff61de65668 18896->18897 18898 7ff61de5fb13 18897->18898 18899 7ff61de65671 18897->18899 18898->18869 18898->18876 18900 7ff61de54f78 _get_daylight 11 API calls 18899->18900 18901 7ff61de65676 18900->18901 18902 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 18901->18902 18902->18898 18911 7ff61de60348 EnterCriticalSection 18903->18911 19911 7ff61de55480 19912 7ff61de5548b 19911->19912 19920 7ff61de5f314 19912->19920 19933 7ff61de60348 EnterCriticalSection 19920->19933 19938 7ff61de6ae6e 19939 7ff61de6ae7d 19938->19939 19940 7ff61de6ae87 19938->19940 19942 7ff61de603a8 LeaveCriticalSection 19939->19942 20047 7ff61de6add9 20050 7ff61de554e8 LeaveCriticalSection 20047->20050 19944 7ff61de6ac53 19946 7ff61de6ac63 19944->19946 19948 7ff61de554e8 LeaveCriticalSection 19946->19948 19025 7ff61de599d1 19026 7ff61de5a448 45 API calls 19025->19026 19027 7ff61de599d6 19026->19027 19028 7ff61de599fd GetModuleHandleW 19027->19028 19029 7ff61de59a47 19027->19029 19028->19029 19035 7ff61de59a0a 19028->19035 19037 7ff61de598d4 19029->19037 19035->19029 19051 7ff61de59af8 GetModuleHandleExW 19035->19051 19057 7ff61de60348 EnterCriticalSection 19037->19057 19052 7ff61de59b2c GetProcAddress 19051->19052 19053 7ff61de59b55 19051->19053 19054 7ff61de59b3e 19052->19054 19055 7ff61de59b5a FreeLibrary 19053->19055 19056 7ff61de59b61 19053->19056 19054->19053 19055->19056 19056->19029 19078 7ff61de4bb50 19079 7ff61de4bb7e 19078->19079 19080 7ff61de4bb65 19078->19080 19080->19079 19082 7ff61de5d66c 12 API calls 19080->19082 19081 7ff61de4bbde 19082->19081 20168 7ff61de4cbc0 20169 7ff61de4cbd0 20168->20169 20185 7ff61de59c18 20169->20185 20171 7ff61de4cbdc 20191 7ff61de4ceb8 20171->20191 20173 7ff61de4d19c 7 API calls 20176 7ff61de4cc75 20173->20176 20174 7ff61de4cbf4 _RTC_Initialize 20183 7ff61de4cc49 20174->20183 20196 7ff61de4d068 20174->20196 20177 7ff61de4cc09 20199 7ff61de59084 20177->20199 20183->20173 20184 7ff61de4cc65 20183->20184 20186 7ff61de59c29 20185->20186 20187 7ff61de59c31 20186->20187 20188 7ff61de54f78 _get_daylight 11 API calls 20186->20188 20187->20171 20189 7ff61de59c40 20188->20189 20190 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 20189->20190 20190->20187 20192 7ff61de4cec9 20191->20192 20195 7ff61de4cece __scrt_acquire_startup_lock 20191->20195 20193 7ff61de4d19c 7 API calls 20192->20193 20192->20195 20194 7ff61de4cf42 20193->20194 20195->20174 20224 7ff61de4d02c 20196->20224 20198 7ff61de4d071 20198->20177 20200 7ff61de590a4 20199->20200 20207 7ff61de4cc15 20199->20207 20201 7ff61de590ac 20200->20201 20202 7ff61de590c2 GetModuleFileNameW 20200->20202 20203 7ff61de54f78 _get_daylight 11 API calls 20201->20203 20205 7ff61de590ed 20202->20205 20204 7ff61de590b1 20203->20204 20206 7ff61de5a950 _invalid_parameter_noinfo 37 API calls 20204->20206 20208 7ff61de59024 11 API calls 20205->20208 20206->20207 20207->20183 20223 7ff61de4d13c InitializeSListHead 20207->20223 20209 7ff61de5912d 20208->20209 20210 7ff61de59135 20209->20210 20214 7ff61de5914d 20209->20214 20211 7ff61de54f78 _get_daylight 11 API calls 20210->20211 20212 7ff61de5913a 20211->20212 20213 7ff61de5a9b8 __free_lconv_num 11 API calls 20212->20213 20213->20207 20215 7ff61de5916f 20214->20215 20217 7ff61de5919b 20214->20217 20218 7ff61de591b4 20214->20218 20216 7ff61de5a9b8 __free_lconv_num 11 API calls 20215->20216 20216->20207 20219 7ff61de5a9b8 __free_lconv_num 11 API calls 20217->20219 20221 7ff61de5a9b8 __free_lconv_num 11 API calls 20218->20221 20220 7ff61de591a4 20219->20220 20222 7ff61de5a9b8 __free_lconv_num 11 API calls 20220->20222 20221->20215 20222->20207 20225 7ff61de4d046 20224->20225 20227 7ff61de4d03f 20224->20227 20228 7ff61de5a25c 20225->20228 20227->20198 20231 7ff61de59e98 20228->20231 20238 7ff61de60348 EnterCriticalSection 20231->20238 19949 7ff61de5b040 19950 7ff61de5b045 19949->19950 19951 7ff61de5b05a 19949->19951 19955 7ff61de5b060 19950->19955 19956 7ff61de5b0a2 19955->19956 19957 7ff61de5b0aa 19955->19957 19958 7ff61de5a9b8 __free_lconv_num 11 API calls 19956->19958 19959 7ff61de5a9b8 __free_lconv_num 11 API calls 19957->19959 19958->19957 19960 7ff61de5b0b7 19959->19960 19961 7ff61de5a9b8 __free_lconv_num 11 API calls 19960->19961 19962 7ff61de5b0c4 19961->19962 19963 7ff61de5a9b8 __free_lconv_num 11 API calls 19962->19963 19964 7ff61de5b0d1 19963->19964 19965 7ff61de5a9b8 __free_lconv_num 11 API calls 19964->19965 19966 7ff61de5b0de 19965->19966 19967 7ff61de5a9b8 __free_lconv_num 11 API calls 19966->19967 19968 7ff61de5b0eb 19967->19968 19969 7ff61de5a9b8 __free_lconv_num 11 API calls 19968->19969 19970 7ff61de5b0f8 19969->19970 19971 7ff61de5a9b8 __free_lconv_num 11 API calls 19970->19971 19972 7ff61de5b105 19971->19972 19973 7ff61de5a9b8 __free_lconv_num 11 API calls 19972->19973 19974 7ff61de5b115 19973->19974 19975 7ff61de5a9b8 __free_lconv_num 11 API calls 19974->19975 19976 7ff61de5b125 19975->19976 19981 7ff61de5af04 19976->19981 19995 7ff61de60348 EnterCriticalSection 19981->19995 20242 7ff61de59dc0 20245 7ff61de59d3c 20242->20245 20252 7ff61de60348 EnterCriticalSection 20245->20252

                                                                                                                                        Executed Functions

                                                                                                                                        Function 00007FF61DE48BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 0 7ff61de48bd0-7ff61de48d16 call 7ff61de4c8c0 call 7ff61de49400 SetConsoleCtrlHandler GetStartupInfoW call 7ff61de55460 call 7ff61de5a4ec call 7ff61de5878c call 7ff61de55460 call 7ff61de5a4ec call 7ff61de5878c call 7ff61de55460 call 7ff61de5a4ec call 7ff61de5878c GetCommandLineW CreateProcessW 23 7ff61de48d3d-7ff61de48d79 RegisterClassW 0->23 24 7ff61de48d18-7ff61de48d38 GetLastError call 7ff61de42c50 0->24 26 7ff61de48d7b GetLastError 23->26 27 7ff61de48d81-7ff61de48dd5 CreateWindowExW 23->27 31 7ff61de49029-7ff61de4904f call 7ff61de4c5c0 24->31 26->27 29 7ff61de48dd7-7ff61de48ddd GetLastError 27->29 30 7ff61de48ddf-7ff61de48de4 ShowWindow 27->30 32 7ff61de48dea-7ff61de48dfa WaitForSingleObject 29->32 30->32 34 7ff61de48dfc 32->34 35 7ff61de48e78-7ff61de48e7f 32->35 39 7ff61de48e00-7ff61de48e03 34->39 36 7ff61de48ec2-7ff61de48ec9 35->36 37 7ff61de48e81-7ff61de48e91 WaitForSingleObject 35->37 42 7ff61de48ecf-7ff61de48ee5 QueryPerformanceFrequency QueryPerformanceCounter 36->42 43 7ff61de48fb0-7ff61de48fc9 GetMessageW 36->43 40 7ff61de48e97-7ff61de48ea7 TerminateProcess 37->40 41 7ff61de48fe8-7ff61de48ff2 37->41 44 7ff61de48e0b-7ff61de48e12 39->44 45 7ff61de48e05 GetLastError 39->45 51 7ff61de48ea9 GetLastError 40->51 52 7ff61de48eaf-7ff61de48ebd WaitForSingleObject 40->52 49 7ff61de48ff4-7ff61de48ffa DestroyWindow 41->49 50 7ff61de49001-7ff61de49025 GetExitCodeProcess CloseHandle * 2 41->50 53 7ff61de48ef0-7ff61de48f28 MsgWaitForMultipleObjects PeekMessageW 42->53 47 7ff61de48fcb-7ff61de48fd9 TranslateMessage DispatchMessageW 43->47 48 7ff61de48fdf-7ff61de48fe6 43->48 44->37 46 7ff61de48e14-7ff61de48e31 PeekMessageW 44->46 45->44 54 7ff61de48e66-7ff61de48e76 WaitForSingleObject 46->54 55 7ff61de48e33-7ff61de48e64 TranslateMessage DispatchMessageW PeekMessageW 46->55 47->48 48->41 48->43 49->50 50->31 51->52 52->41 56 7ff61de48f2a 53->56 57 7ff61de48f63-7ff61de48f6a 53->57 54->35 54->39 55->54 55->55 58 7ff61de48f30-7ff61de48f61 TranslateMessage DispatchMessageW PeekMessageW 56->58 57->43 59 7ff61de48f6c-7ff61de48f95 QueryPerformanceCounter 57->59 58->57 58->58 59->53 60 7ff61de48f9b-7ff61de48fa2 59->60 60->41 61 7ff61de48fa4-7ff61de48fa8 60->61 61->43
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                        • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                        • API String ID: 3832162212-3165540532
                                                                                                                                        • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                        • Instruction ID: e27754ec4510f2d5bbe0bc35d16d6f85379747701d8a116bd19a7b1b9eca2924
                                                                                                                                        • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                        • Instruction Fuzzy Hash: C2D12B32A08E8696EB109F74E8942AF3764FB84F6AF404235DA5DD2AA4EF3CD545C740
                                                                                                                                        Function 00007FF61DE41000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 62 7ff61de41000-7ff61de43806 call 7ff61de4fe88 call 7ff61de4fe90 call 7ff61de4c8c0 call 7ff61de55460 call 7ff61de554f4 call 7ff61de436b0 76 7ff61de43808-7ff61de4380f 62->76 77 7ff61de43814-7ff61de43836 call 7ff61de41950 62->77 78 7ff61de43c97-7ff61de43cb2 call 7ff61de4c5c0 76->78 83 7ff61de4383c-7ff61de43856 call 7ff61de41c80 77->83 84 7ff61de4391b-7ff61de43931 call 7ff61de445b0 77->84 87 7ff61de4385b-7ff61de4389b call 7ff61de48a20 83->87 90 7ff61de4396a-7ff61de4397f call 7ff61de42710 84->90 91 7ff61de43933-7ff61de43960 call 7ff61de47f80 84->91 96 7ff61de4389d-7ff61de438a3 87->96 97 7ff61de438c1-7ff61de438cc call 7ff61de54fa0 87->97 99 7ff61de43c8f 90->99 103 7ff61de43984-7ff61de439a6 call 7ff61de41c80 91->103 104 7ff61de43962-7ff61de43965 call 7ff61de500bc 91->104 100 7ff61de438af-7ff61de438bd call 7ff61de48b90 96->100 101 7ff61de438a5-7ff61de438ad 96->101 111 7ff61de439fc-7ff61de43a2a call 7ff61de48b30 call 7ff61de48b90 * 3 97->111 112 7ff61de438d2-7ff61de438e1 call 7ff61de48a20 97->112 99->78 100->97 101->100 113 7ff61de439b0-7ff61de439b9 103->113 104->90 138 7ff61de43a2f-7ff61de43a3e call 7ff61de48a20 111->138 121 7ff61de438e7-7ff61de438ed 112->121 122 7ff61de439f4-7ff61de439f7 call 7ff61de54fa0 112->122 113->113 116 7ff61de439bb-7ff61de439d8 call 7ff61de41950 113->116 116->87 130 7ff61de439de-7ff61de439ef call 7ff61de42710 116->130 123 7ff61de438f0-7ff61de438fc 121->123 122->111 127 7ff61de438fe-7ff61de43903 123->127 128 7ff61de43905-7ff61de43908 123->128 127->123 127->128 128->122 131 7ff61de4390e-7ff61de43916 call 7ff61de54fa0 128->131 130->99 131->138 141 7ff61de43b45-7ff61de43b53 138->141 142 7ff61de43a44-7ff61de43a47 138->142 143 7ff61de43b59-7ff61de43b5d 141->143 144 7ff61de43a67 141->144 142->141 145 7ff61de43a4d-7ff61de43a50 142->145 146 7ff61de43a6b-7ff61de43a90 call 7ff61de54fa0 143->146 144->146 147 7ff61de43a56-7ff61de43a5a 145->147 148 7ff61de43b14-7ff61de43b17 145->148 157 7ff61de43aab-7ff61de43ac0 146->157 158 7ff61de43a92-7ff61de43aa6 call 7ff61de48b30 146->158 147->148 149 7ff61de43a60 147->149 150 7ff61de43b19-7ff61de43b1d 148->150 151 7ff61de43b2f-7ff61de43b40 call 7ff61de42710 148->151 149->144 150->151 153 7ff61de43b1f-7ff61de43b2a 150->153 159 7ff61de43c7f-7ff61de43c87 151->159 153->146 161 7ff61de43be8-7ff61de43bfa call 7ff61de48a20 157->161 162 7ff61de43ac6-7ff61de43aca 157->162 158->157 159->99 170 7ff61de43bfc-7ff61de43c02 161->170 171 7ff61de43c2e 161->171 164 7ff61de43bcd-7ff61de43be2 call 7ff61de41940 162->164 165 7ff61de43ad0-7ff61de43ae8 call 7ff61de552c0 162->165 164->161 164->162 175 7ff61de43aea-7ff61de43b02 call 7ff61de552c0 165->175 176 7ff61de43b62-7ff61de43b7a call 7ff61de552c0 165->176 173 7ff61de43c1e-7ff61de43c2c 170->173 174 7ff61de43c04-7ff61de43c1c 170->174 177 7ff61de43c31-7ff61de43c40 call 7ff61de54fa0 171->177 173->177 174->177 175->164 186 7ff61de43b08-7ff61de43b0f 175->186 184 7ff61de43b87-7ff61de43b9f call 7ff61de552c0 176->184 185 7ff61de43b7c-7ff61de43b80 176->185 187 7ff61de43c46-7ff61de43c4a 177->187 188 7ff61de43d41-7ff61de43d63 call 7ff61de444d0 177->188 200 7ff61de43bac-7ff61de43bc4 call 7ff61de552c0 184->200 201 7ff61de43ba1-7ff61de43ba5 184->201 185->184 186->164 190 7ff61de43c50-7ff61de43c5f call 7ff61de490e0 187->190 191 7ff61de43cd4-7ff61de43ce6 call 7ff61de48a20 187->191 198 7ff61de43d71-7ff61de43d82 call 7ff61de41c80 188->198 199 7ff61de43d65-7ff61de43d6f call 7ff61de44620 188->199 203 7ff61de43c61 190->203 204 7ff61de43cb3-7ff61de43cb6 call 7ff61de48850 190->204 205 7ff61de43ce8-7ff61de43ceb 191->205 206 7ff61de43d35-7ff61de43d3c 191->206 213 7ff61de43d87-7ff61de43d96 198->213 199->213 200->164 221 7ff61de43bc6 200->221 201->200 210 7ff61de43c68 call 7ff61de42710 203->210 220 7ff61de43cbb-7ff61de43cbd 204->220 205->206 211 7ff61de43ced-7ff61de43d10 call 7ff61de41c80 205->211 206->210 222 7ff61de43c6d-7ff61de43c77 210->222 228 7ff61de43d2b-7ff61de43d33 call 7ff61de54fa0 211->228 229 7ff61de43d12-7ff61de43d26 call 7ff61de42710 call 7ff61de54fa0 211->229 218 7ff61de43d98-7ff61de43d9f 213->218 219 7ff61de43dc4-7ff61de43dda call 7ff61de49400 213->219 218->219 224 7ff61de43da1-7ff61de43da5 218->224 234 7ff61de43de8-7ff61de43e04 SetDllDirectoryW 219->234 235 7ff61de43ddc 219->235 226 7ff61de43cc8-7ff61de43ccf 220->226 227 7ff61de43cbf-7ff61de43cc6 220->227 221->164 222->159 224->219 230 7ff61de43da7-7ff61de43dbe SetDllDirectoryW LoadLibraryExW 224->230 226->213 227->210 228->213 229->222 230->219 236 7ff61de43e0a-7ff61de43e19 call 7ff61de48a20 234->236 237 7ff61de43f01-7ff61de43f08 234->237 235->234 249 7ff61de43e1b-7ff61de43e21 236->249 250 7ff61de43e32-7ff61de43e3c call 7ff61de54fa0 236->250 242 7ff61de43ffc-7ff61de44004 237->242 243 7ff61de43f0e-7ff61de43f15 237->243 247 7ff61de44029-7ff61de4405b call 7ff61de436a0 call 7ff61de43360 call 7ff61de43670 call 7ff61de46fb0 call 7ff61de46d60 242->247 248 7ff61de44006-7ff61de44023 PostMessageW GetMessageW 242->248 243->242 246 7ff61de43f1b-7ff61de43f25 call 7ff61de433c0 243->246 246->222 260 7ff61de43f2b-7ff61de43f3f call 7ff61de490c0 246->260 248->247 254 7ff61de43e2d-7ff61de43e2f 249->254 255 7ff61de43e23-7ff61de43e2b 249->255 263 7ff61de43ef2-7ff61de43efc call 7ff61de48b30 250->263 264 7ff61de43e42-7ff61de43e48 250->264 254->250 255->254 269 7ff61de43f41-7ff61de43f5e PostMessageW GetMessageW 260->269 270 7ff61de43f64-7ff61de43fa0 call 7ff61de48b30 call 7ff61de48bd0 call 7ff61de46fb0 call 7ff61de46d60 call 7ff61de48ad0 260->270 263->237 264->263 268 7ff61de43e4e-7ff61de43e54 264->268 272 7ff61de43e56-7ff61de43e58 268->272 273 7ff61de43e5f-7ff61de43e61 268->273 269->270 308 7ff61de43fa5-7ff61de43fa7 270->308 276 7ff61de43e67-7ff61de43e83 call 7ff61de46db0 call 7ff61de47330 272->276 277 7ff61de43e5a 272->277 273->237 273->276 289 7ff61de43e8e-7ff61de43e95 276->289 290 7ff61de43e85-7ff61de43e8c 276->290 277->237 293 7ff61de43e97-7ff61de43ea4 call 7ff61de46df0 289->293 294 7ff61de43eaf-7ff61de43eb9 call 7ff61de471a0 289->294 292 7ff61de43edb-7ff61de43ef0 call 7ff61de42a50 call 7ff61de46fb0 call 7ff61de46d60 290->292 292->237 293->294 305 7ff61de43ea6-7ff61de43ead 293->305 306 7ff61de43ebb-7ff61de43ec2 294->306 307 7ff61de43ec4-7ff61de43ed2 call 7ff61de474e0 294->307 305->292 306->292 307->237 317 7ff61de43ed4 307->317 311 7ff61de43fe9-7ff61de43ff7 call 7ff61de41900 308->311 312 7ff61de43fa9-7ff61de43fb3 call 7ff61de49200 308->312 311->222 312->311 321 7ff61de43fb5-7ff61de43fca 312->321 317->292 322 7ff61de43fcc-7ff61de43fdf call 7ff61de42710 call 7ff61de41900 321->322 323 7ff61de43fe4 call 7ff61de42a50 321->323 322->222 323->311
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                        • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                        • API String ID: 2776309574-4232158417
                                                                                                                                        • Opcode ID: 5175dd211561270c01c090de14ed05897007262ae42d5fb09ddae339d6dfd05a
                                                                                                                                        • Instruction ID: d72b116952b01620a26ea5361fca08cb2b460b6537ecd962040bfebb9601c786
                                                                                                                                        • Opcode Fuzzy Hash: 5175dd211561270c01c090de14ed05897007262ae42d5fb09ddae339d6dfd05a
                                                                                                                                        • Instruction Fuzzy Hash: A5328C21E4CE8291FB29EB2195543BB67A1AF44FA6F844036DA5DC32D6FF2CE554C310
                                                                                                                                        Function 00007FF61DE65C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 477 7ff61de65c70-7ff61de65cab call 7ff61de655f8 call 7ff61de65600 call 7ff61de65668 484 7ff61de65ed5-7ff61de65f21 call 7ff61de5a970 call 7ff61de655f8 call 7ff61de65600 call 7ff61de65668 477->484 485 7ff61de65cb1-7ff61de65cbc call 7ff61de65608 477->485 512 7ff61de65f27-7ff61de65f32 call 7ff61de65608 484->512 513 7ff61de6605f-7ff61de660cd call 7ff61de5a970 call 7ff61de615e8 484->513 485->484 490 7ff61de65cc2-7ff61de65ccc 485->490 492 7ff61de65cee-7ff61de65cf2 490->492 493 7ff61de65cce-7ff61de65cd1 490->493 497 7ff61de65cf5-7ff61de65cfd 492->497 495 7ff61de65cd4-7ff61de65cdf 493->495 498 7ff61de65cea-7ff61de65cec 495->498 499 7ff61de65ce1-7ff61de65ce8 495->499 497->497 501 7ff61de65cff-7ff61de65d12 call 7ff61de5d66c 497->501 498->492 503 7ff61de65d1b-7ff61de65d29 498->503 499->495 499->498 507 7ff61de65d2a-7ff61de65d36 call 7ff61de5a9b8 501->507 508 7ff61de65d14-7ff61de65d16 call 7ff61de5a9b8 501->508 518 7ff61de65d3d-7ff61de65d45 507->518 508->503 512->513 520 7ff61de65f38-7ff61de65f43 call 7ff61de65638 512->520 530 7ff61de660db-7ff61de660de 513->530 531 7ff61de660cf-7ff61de660d6 513->531 518->518 522 7ff61de65d47-7ff61de65d58 call 7ff61de604e4 518->522 520->513 529 7ff61de65f49-7ff61de65f6c call 7ff61de5a9b8 GetTimeZoneInformation 520->529 522->484 532 7ff61de65d5e-7ff61de65db4 call 7ff61de6a540 * 4 call 7ff61de65b8c 522->532 544 7ff61de65f72-7ff61de65f93 529->544 545 7ff61de66034-7ff61de6605e call 7ff61de655f0 call 7ff61de655e0 call 7ff61de655e8 529->545 534 7ff61de66115-7ff61de66128 call 7ff61de5d66c 530->534 535 7ff61de660e0 530->535 536 7ff61de6616b-7ff61de6616e 531->536 590 7ff61de65db6-7ff61de65dba 532->590 550 7ff61de6612a 534->550 551 7ff61de66133-7ff61de6614e call 7ff61de615e8 534->551 539 7ff61de660e3 535->539 536->539 541 7ff61de66174-7ff61de6617c call 7ff61de65c70 536->541 546 7ff61de660e8-7ff61de66114 call 7ff61de5a9b8 call 7ff61de4c5c0 539->546 547 7ff61de660e3 call 7ff61de65eec 539->547 541->546 552 7ff61de65f95-7ff61de65f9b 544->552 553 7ff61de65f9e-7ff61de65fa5 544->553 547->546 558 7ff61de6612c-7ff61de66131 call 7ff61de5a9b8 550->558 574 7ff61de66155-7ff61de66167 call 7ff61de5a9b8 551->574 575 7ff61de66150-7ff61de66153 551->575 552->553 560 7ff61de65fa7-7ff61de65faf 553->560 561 7ff61de65fb9 553->561 558->535 560->561 569 7ff61de65fb1-7ff61de65fb7 560->569 566 7ff61de65fbb-7ff61de6602f call 7ff61de6a540 * 4 call 7ff61de62bcc call 7ff61de66184 * 2 561->566 566->545 569->566 574->536 575->558 592 7ff61de65dbc 590->592 593 7ff61de65dc0-7ff61de65dc4 590->593 592->593 593->590 595 7ff61de65dc6-7ff61de65deb call 7ff61de56bc8 593->595 601 7ff61de65dee-7ff61de65df2 595->601 603 7ff61de65df4-7ff61de65dff 601->603 604 7ff61de65e01-7ff61de65e05 601->604 603->604 606 7ff61de65e07-7ff61de65e0b 603->606 604->601 608 7ff61de65e0d-7ff61de65e35 call 7ff61de56bc8 606->608 609 7ff61de65e8c-7ff61de65e90 606->609 617 7ff61de65e37 608->617 618 7ff61de65e53-7ff61de65e57 608->618 611 7ff61de65e97-7ff61de65ea4 609->611 612 7ff61de65e92-7ff61de65e94 609->612 614 7ff61de65ea6-7ff61de65ebc call 7ff61de65b8c 611->614 615 7ff61de65ebf-7ff61de65ece call 7ff61de655f0 call 7ff61de655e0 611->615 612->611 614->615 615->484 621 7ff61de65e3a-7ff61de65e41 617->621 618->609 623 7ff61de65e59-7ff61de65e77 call 7ff61de56bc8 618->623 621->618 624 7ff61de65e43-7ff61de65e51 621->624 629 7ff61de65e83-7ff61de65e8a 623->629 624->618 624->621 629->609 630 7ff61de65e79-7ff61de65e7d 629->630 630->609 631 7ff61de65e7f 630->631 631->629
                                                                                                                                        APIs
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65CB5
                                                                                                                                          • Part of subcall function 00007FF61DE65608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE6561C
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9CE
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: GetLastError.KERNEL32(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9D8
                                                                                                                                          • Part of subcall function 00007FF61DE5A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF61DE5A94F,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5A979
                                                                                                                                          • Part of subcall function 00007FF61DE5A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF61DE5A94F,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5A99E
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65CA4
                                                                                                                                          • Part of subcall function 00007FF61DE65668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE6567C
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F1A
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F2B
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F3C
                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF61DE6617C), ref: 00007FF61DE65F63
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                        • API String ID: 4070488512-239921721
                                                                                                                                        • Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                        • Instruction ID: 178bb13217553cb32c9d94d7758065eab1af0fa17b33aa78e3c71c0db9c93060
                                                                                                                                        • Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                        • Instruction Fuzzy Hash: F8D19D26B08A9286EB20DF26D4411BF6761EB44FA6F44813AEB0DC7696FF3CE441C740
                                                                                                                                        Function 00007FF61DE669D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 691 7ff61de669d4-7ff61de66a47 call 7ff61de66708 694 7ff61de66a49-7ff61de66a52 call 7ff61de54f58 691->694 695 7ff61de66a61-7ff61de66a6b call 7ff61de58590 691->695 700 7ff61de66a55-7ff61de66a5c call 7ff61de54f78 694->700 701 7ff61de66a6d-7ff61de66a84 call 7ff61de54f58 call 7ff61de54f78 695->701 702 7ff61de66a86-7ff61de66aef CreateFileW 695->702 715 7ff61de66da2-7ff61de66dc2 700->715 701->700 703 7ff61de66b6c-7ff61de66b77 GetFileType 702->703 704 7ff61de66af1-7ff61de66af7 702->704 710 7ff61de66bca-7ff61de66bd1 703->710 711 7ff61de66b79-7ff61de66bb4 GetLastError call 7ff61de54eec CloseHandle 703->711 707 7ff61de66b39-7ff61de66b67 GetLastError call 7ff61de54eec 704->707 708 7ff61de66af9-7ff61de66afd 704->708 707->700 708->707 713 7ff61de66aff-7ff61de66b37 CreateFileW 708->713 718 7ff61de66bd9-7ff61de66bdc 710->718 719 7ff61de66bd3-7ff61de66bd7 710->719 711->700 726 7ff61de66bba-7ff61de66bc5 call 7ff61de54f78 711->726 713->703 713->707 720 7ff61de66be2-7ff61de66c37 call 7ff61de584a8 718->720 721 7ff61de66bde 718->721 719->720 729 7ff61de66c56-7ff61de66c87 call 7ff61de66488 720->729 730 7ff61de66c39-7ff61de66c45 call 7ff61de66910 720->730 721->720 726->700 737 7ff61de66c8d-7ff61de66ccf 729->737 738 7ff61de66c89-7ff61de66c8b 729->738 730->729 736 7ff61de66c47 730->736 741 7ff61de66c49-7ff61de66c51 call 7ff61de5ab30 736->741 739 7ff61de66cf1-7ff61de66cfc 737->739 740 7ff61de66cd1-7ff61de66cd5 737->740 738->741 743 7ff61de66d02-7ff61de66d06 739->743 744 7ff61de66da0 739->744 740->739 742 7ff61de66cd7-7ff61de66cec 740->742 741->715 742->739 743->744 746 7ff61de66d0c-7ff61de66d51 CloseHandle CreateFileW 743->746 744->715 748 7ff61de66d86-7ff61de66d9b 746->748 749 7ff61de66d53-7ff61de66d81 GetLastError call 7ff61de54eec call 7ff61de586d0 746->749 748->744 749->748
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1617910340-0
                                                                                                                                        • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                        • Instruction ID: b8cf468e86b654d00b84d2f347ae2e55ad735c6760b3df97905e3a04ab7590bb
                                                                                                                                        • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                        • Instruction Fuzzy Hash: 49C1BF36B28E8185EB10DF69C4902AE3761FB49FA9F015229DF2E97795EF38E451C700
                                                                                                                                        Function 00007FF61DE483B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        • FindFirstFileW.KERNELBASE(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE4841B
                                                                                                                                        • RemoveDirectoryW.KERNEL32(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE4849E
                                                                                                                                        • DeleteFileW.KERNELBASE(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE484BD
                                                                                                                                        • FindNextFileW.KERNELBASE(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE484CB
                                                                                                                                        • FindClose.KERNELBASE(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE484DC
                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,00007FF61DE48B09,00007FF61DE43FA5), ref: 00007FF61DE484E5
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                        • String ID: %s\*
                                                                                                                                        • API String ID: 1057558799-766152087
                                                                                                                                        • Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                        • Instruction ID: 0a98d5f37cf88bca55995b1017a6d67c07f32d928e7bae29b818a3f0beaf1815
                                                                                                                                        • Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                        • Instruction Fuzzy Hash: 35412E21A0CD8295EE609F24A4945BF63A0FB98F76F800632D69DC2694FF3CD546C740
                                                                                                                                        Function 00007FF61DE65EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1012 7ff61de65eec-7ff61de65f21 call 7ff61de655f8 call 7ff61de65600 call 7ff61de65668 1019 7ff61de65f27-7ff61de65f32 call 7ff61de65608 1012->1019 1020 7ff61de6605f-7ff61de660cd call 7ff61de5a970 call 7ff61de615e8 1012->1020 1019->1020 1025 7ff61de65f38-7ff61de65f43 call 7ff61de65638 1019->1025 1032 7ff61de660db-7ff61de660de 1020->1032 1033 7ff61de660cf-7ff61de660d6 1020->1033 1025->1020 1031 7ff61de65f49-7ff61de65f6c call 7ff61de5a9b8 GetTimeZoneInformation 1025->1031 1043 7ff61de65f72-7ff61de65f93 1031->1043 1044 7ff61de66034-7ff61de6605e call 7ff61de655f0 call 7ff61de655e0 call 7ff61de655e8 1031->1044 1035 7ff61de66115-7ff61de66128 call 7ff61de5d66c 1032->1035 1036 7ff61de660e0 1032->1036 1037 7ff61de6616b-7ff61de6616e 1033->1037 1048 7ff61de6612a 1035->1048 1049 7ff61de66133-7ff61de6614e call 7ff61de615e8 1035->1049 1039 7ff61de660e3 1036->1039 1037->1039 1040 7ff61de66174-7ff61de6617c call 7ff61de65c70 1037->1040 1045 7ff61de660e8-7ff61de66114 call 7ff61de5a9b8 call 7ff61de4c5c0 1039->1045 1046 7ff61de660e3 call 7ff61de65eec 1039->1046 1040->1045 1050 7ff61de65f95-7ff61de65f9b 1043->1050 1051 7ff61de65f9e-7ff61de65fa5 1043->1051 1046->1045 1055 7ff61de6612c-7ff61de66131 call 7ff61de5a9b8 1048->1055 1068 7ff61de66155-7ff61de66167 call 7ff61de5a9b8 1049->1068 1069 7ff61de66150-7ff61de66153 1049->1069 1050->1051 1057 7ff61de65fa7-7ff61de65faf 1051->1057 1058 7ff61de65fb9 1051->1058 1055->1036 1057->1058 1064 7ff61de65fb1-7ff61de65fb7 1057->1064 1061 7ff61de65fbb-7ff61de6602f call 7ff61de6a540 * 4 call 7ff61de62bcc call 7ff61de66184 * 2 1058->1061 1061->1044 1064->1061 1068->1037 1069->1055
                                                                                                                                        APIs
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F1A
                                                                                                                                          • Part of subcall function 00007FF61DE65668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE6567C
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F2B
                                                                                                                                          • Part of subcall function 00007FF61DE65608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE6561C
                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF61DE65F3C
                                                                                                                                          • Part of subcall function 00007FF61DE65638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE6564C
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9CE
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: GetLastError.KERNEL32(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9D8
                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF61DE6617C), ref: 00007FF61DE65F63
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                        • API String ID: 3458911817-239921721
                                                                                                                                        • Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                        • Instruction ID: 0970702db869da2cfbb8776efa966b8e358c276c599559b7dcd8fb352aa5364b
                                                                                                                                        • Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                        • Instruction Fuzzy Hash: 4C515232A18A8286E720DF21D5815AF7760BB49FA5F44413AEB5DC76A6FF3CE441CB40
                                                                                                                                        Function 00007FF61DE492F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                        • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                        • Instruction ID: 52469781c954ed7385c7acbc4b10fa027c4dfb2036f7bea9ee693902d9fb728e
                                                                                                                                        • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                        • Instruction Fuzzy Hash: 61F06D22618B4187F7608F50B45976B7350BB45B79F440335DA6D826D4EF3CD4598600
                                                                                                                                        Function 00007FF61DE41950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 329 7ff61de41950-7ff61de4198b call 7ff61de445b0 332 7ff61de41991-7ff61de419d1 call 7ff61de47f80 329->332 333 7ff61de41c4e-7ff61de41c72 call 7ff61de4c5c0 329->333 338 7ff61de419d7-7ff61de419e7 call 7ff61de50744 332->338 339 7ff61de41c3b-7ff61de41c3e call 7ff61de500bc 332->339 344 7ff61de419e9-7ff61de41a03 call 7ff61de54f78 call 7ff61de42910 338->344 345 7ff61de41a08-7ff61de41a24 call 7ff61de5040c 338->345 342 7ff61de41c43-7ff61de41c4b 339->342 342->333 344->339 351 7ff61de41a26-7ff61de41a40 call 7ff61de54f78 call 7ff61de42910 345->351 352 7ff61de41a45-7ff61de41a5a call 7ff61de54f98 345->352 351->339 358 7ff61de41a5c-7ff61de41a76 call 7ff61de54f78 call 7ff61de42910 352->358 359 7ff61de41a7b-7ff61de41afc call 7ff61de41c80 * 2 call 7ff61de50744 352->359 358->339 371 7ff61de41b01-7ff61de41b14 call 7ff61de54fb4 359->371 374 7ff61de41b16-7ff61de41b30 call 7ff61de54f78 call 7ff61de42910 371->374 375 7ff61de41b35-7ff61de41b4e call 7ff61de5040c 371->375 374->339 381 7ff61de41b50-7ff61de41b6a call 7ff61de54f78 call 7ff61de42910 375->381 382 7ff61de41b6f-7ff61de41b8b call 7ff61de50180 375->382 381->339 389 7ff61de41b8d-7ff61de41b99 call 7ff61de42710 382->389 390 7ff61de41b9e-7ff61de41bac 382->390 389->339 390->339 391 7ff61de41bb2-7ff61de41bb9 390->391 395 7ff61de41bc1-7ff61de41bc7 391->395 396 7ff61de41bc9-7ff61de41bd6 395->396 397 7ff61de41be0-7ff61de41bef 395->397 398 7ff61de41bf1-7ff61de41bfa 396->398 397->397 397->398 399 7ff61de41bfc-7ff61de41bff 398->399 400 7ff61de41c0f 398->400 399->400 401 7ff61de41c01-7ff61de41c04 399->401 402 7ff61de41c11-7ff61de41c24 400->402 401->400 403 7ff61de41c06-7ff61de41c09 401->403 404 7ff61de41c26 402->404 405 7ff61de41c2d-7ff61de41c39 402->405 403->400 406 7ff61de41c0b-7ff61de41c0d 403->406 404->405 405->339 405->395 406->402
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FF61DE47F80: _fread_nolock.LIBCMT ref: 00007FF61DE4802A
                                                                                                                                        • _fread_nolock.LIBCMT ref: 00007FF61DE41A1B
                                                                                                                                          • Part of subcall function 00007FF61DE42910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF61DE41B6A), ref: 00007FF61DE4295E
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _fread_nolock$CurrentProcess
                                                                                                                                        • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                        • API String ID: 2397952137-3497178890
                                                                                                                                        • Opcode ID: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
                                                                                                                                        • Instruction ID: 19841400f2b1ba5b2bfbaa3f585fbb9b23ff546382527f49a21c4edb1c791c6c
                                                                                                                                        • Opcode Fuzzy Hash: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
                                                                                                                                        • Instruction Fuzzy Hash: F5818D75B08E8686EB64DB24D4402BB23A0EF48FA6F444535EA8DC7786FF3CE5858750
                                                                                                                                        Function 00007FF61DE41600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 407 7ff61de41600-7ff61de41611 408 7ff61de41637-7ff61de41651 call 7ff61de445b0 407->408 409 7ff61de41613-7ff61de4161c call 7ff61de41050 407->409 416 7ff61de41653-7ff61de41681 call 7ff61de54f78 call 7ff61de42910 408->416 417 7ff61de41682-7ff61de4169c call 7ff61de445b0 408->417 414 7ff61de4162e-7ff61de41636 409->414 415 7ff61de4161e-7ff61de41629 call 7ff61de42710 409->415 415->414 424 7ff61de416b8-7ff61de416cf call 7ff61de50744 417->424 425 7ff61de4169e-7ff61de416b3 call 7ff61de42710 417->425 432 7ff61de416f9-7ff61de416fd 424->432 433 7ff61de416d1-7ff61de416f4 call 7ff61de54f78 call 7ff61de42910 424->433 431 7ff61de41821-7ff61de41824 call 7ff61de500bc 425->431 440 7ff61de41829-7ff61de4183b 431->440 434 7ff61de41717-7ff61de41737 call 7ff61de54fb4 432->434 435 7ff61de416ff-7ff61de4170b call 7ff61de41210 432->435 446 7ff61de41819-7ff61de4181c call 7ff61de500bc 433->446 447 7ff61de41739-7ff61de4175c call 7ff61de54f78 call 7ff61de42910 434->447 448 7ff61de41761-7ff61de4176c 434->448 442 7ff61de41710-7ff61de41712 435->442 442->446 446->431 460 7ff61de4180f-7ff61de41814 447->460 451 7ff61de41802-7ff61de4180a call 7ff61de54fa0 448->451 452 7ff61de41772-7ff61de41777 448->452 451->460 455 7ff61de41780-7ff61de417a2 call 7ff61de5040c 452->455 462 7ff61de417da-7ff61de417e6 call 7ff61de54f78 455->462 463 7ff61de417a4-7ff61de417bc call 7ff61de50b4c 455->463 460->446 470 7ff61de417ed-7ff61de417f8 call 7ff61de42910 462->470 468 7ff61de417be-7ff61de417c1 463->468 469 7ff61de417c5-7ff61de417d8 call 7ff61de54f78 463->469 468->455 471 7ff61de417c3 468->471 469->470 474 7ff61de417fd 470->474 471->474 474->451
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                        • API String ID: 2050909247-1550345328
                                                                                                                                        • Opcode ID: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
                                                                                                                                        • Instruction ID: f654001b71270d316c149a235a9dc2ea9a30ee53dda5d15b7f15435a0c008ec8
                                                                                                                                        • Opcode Fuzzy Hash: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
                                                                                                                                        • Instruction Fuzzy Hash: F2516965B08E8292EE10AB21A4401BB63A0BF44FB6F844631EE0CC7796FF3CF5459750
                                                                                                                                        Function 00007FF61DE48850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        • GetTempPathW.KERNEL32(?,?,00000000,00007FF61DE43CBB), ref: 00007FF61DE488F4
                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00007FF61DE43CBB), ref: 00007FF61DE488FA
                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,00007FF61DE43CBB), ref: 00007FF61DE4893C
                                                                                                                                          • Part of subcall function 00007FF61DE48A20: GetEnvironmentVariableW.KERNEL32(00007FF61DE4388E), ref: 00007FF61DE48A57
                                                                                                                                          • Part of subcall function 00007FF61DE48A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF61DE48A79
                                                                                                                                          • Part of subcall function 00007FF61DE582A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE582C1
                                                                                                                                          • Part of subcall function 00007FF61DE42810: MessageBoxW.USER32 ref: 00007FF61DE428EA
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                        • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                        • API String ID: 3563477958-1339014028
                                                                                                                                        • Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                        • Instruction ID: 759c8720c3e7d0f582aa25fc97f940dac4fb6485e760308fe8075bba67656ff5
                                                                                                                                        • Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                        • Instruction Fuzzy Hash: AE418E15B19E8250EA60AB66A8952BF1390AF89FE6F844131EE0DC7796FF3CE541C300
                                                                                                                                        Function 00007FF61DE41210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 754 7ff61de41210-7ff61de4126d call 7ff61de4bdf0 757 7ff61de41297-7ff61de412af call 7ff61de54fb4 754->757 758 7ff61de4126f-7ff61de41296 call 7ff61de42710 754->758 763 7ff61de412b1-7ff61de412cf call 7ff61de54f78 call 7ff61de42910 757->763 764 7ff61de412d4-7ff61de412e4 call 7ff61de54fb4 757->764 776 7ff61de41439-7ff61de4144e call 7ff61de4bad0 call 7ff61de54fa0 * 2 763->776 770 7ff61de41309-7ff61de4131b 764->770 771 7ff61de412e6-7ff61de41304 call 7ff61de54f78 call 7ff61de42910 764->771 774 7ff61de41320-7ff61de41345 call 7ff61de5040c 770->774 771->776 782 7ff61de4134b-7ff61de41355 call 7ff61de50180 774->782 783 7ff61de41431 774->783 791 7ff61de41453-7ff61de4146d 776->791 782->783 790 7ff61de4135b-7ff61de41367 782->790 783->776 792 7ff61de41370-7ff61de41398 call 7ff61de4a230 790->792 795 7ff61de41416-7ff61de4142c call 7ff61de42710 792->795 796 7ff61de4139a-7ff61de4139d 792->796 795->783 797 7ff61de41411 796->797 798 7ff61de4139f-7ff61de413a9 796->798 797->795 800 7ff61de413ab-7ff61de413b9 call 7ff61de50b4c 798->800 801 7ff61de413d4-7ff61de413d7 798->801 807 7ff61de413be-7ff61de413c1 800->807 802 7ff61de413d9-7ff61de413e7 call 7ff61de69ea0 801->802 803 7ff61de413ea-7ff61de413ef 801->803 802->803 803->792 806 7ff61de413f5-7ff61de413f8 803->806 809 7ff61de4140c-7ff61de4140f 806->809 810 7ff61de413fa-7ff61de413fd 806->810 811 7ff61de413cf-7ff61de413d2 807->811 812 7ff61de413c3-7ff61de413cd call 7ff61de50180 807->812 809->783 810->795 813 7ff61de413ff-7ff61de41407 810->813 811->795 812->803 812->811 813->774
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                        • API String ID: 2050909247-2813020118
                                                                                                                                        • Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                        • Instruction ID: d17ae7faa3185791224acdd691dc0739e5fa72277ec32a61cd21bdeca68bdfcf
                                                                                                                                        • Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                        • Instruction Fuzzy Hash: E451AF22B08E8285EA619B15A4503BB6791BF85FA6F844235EE4DC7BD9FF3CE505C700
                                                                                                                                        Function 00007FF61DE5ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF61DE5F11A,?,?,-00000018,00007FF61DE5ADC3,?,?,?,00007FF61DE5ACBA,?,?,?,00007FF61DE55FAE), ref: 00007FF61DE5EEFC
                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF61DE5F11A,?,?,-00000018,00007FF61DE5ADC3,?,?,?,00007FF61DE5ACBA,?,?,?,00007FF61DE55FAE), ref: 00007FF61DE5EF08
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressFreeLibraryProc
                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                        • API String ID: 3013587201-537541572
                                                                                                                                        • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                        • Instruction ID: 5b02d9f37c14d6f20d17e4c9d98bc9703f302d10bb4be3de9d85fb129e314973
                                                                                                                                        • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                        • Instruction Fuzzy Hash: 2441CF25B29E1281EA55CB16A80467B2391BF49FF2F889539ED1DC7784FF3CE8058340
                                                                                                                                        Function 00007FF61DE436B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,00007FF61DE43804), ref: 00007FF61DE436E1
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE43804), ref: 00007FF61DE436EB
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42C9E
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42D63
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: MessageBoxW.USER32 ref: 00007FF61DE42D99
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                        • API String ID: 3187769757-2863816727
                                                                                                                                        • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                        • Instruction ID: bcbf32164b2a06d131627cac1db057dd8a3b2c544c38752d36abe038377f86ca
                                                                                                                                        • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                        • Instruction Fuzzy Hash: 71215161F18E8291FA619B20E8553BB2250BF98FB6F804136E69DC25D5FF2CE505C700
                                                                                                                                        Function 00007FF61DE5BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 899 7ff61de5bacc-7ff61de5baf2 900 7ff61de5bb0d-7ff61de5bb11 899->900 901 7ff61de5baf4-7ff61de5bb08 call 7ff61de54f58 call 7ff61de54f78 899->901 903 7ff61de5bee7-7ff61de5bef3 call 7ff61de54f58 call 7ff61de54f78 900->903 904 7ff61de5bb17-7ff61de5bb1e 900->904 915 7ff61de5befe 901->915 922 7ff61de5bef9 call 7ff61de5a950 903->922 904->903 906 7ff61de5bb24-7ff61de5bb52 904->906 906->903 909 7ff61de5bb58-7ff61de5bb5f 906->909 912 7ff61de5bb78-7ff61de5bb7b 909->912 913 7ff61de5bb61-7ff61de5bb73 call 7ff61de54f58 call 7ff61de54f78 909->913 918 7ff61de5bee3-7ff61de5bee5 912->918 919 7ff61de5bb81-7ff61de5bb87 912->919 913->922 920 7ff61de5bf01-7ff61de5bf18 915->920 918->920 919->918 923 7ff61de5bb8d-7ff61de5bb90 919->923 922->915 923->913 924 7ff61de5bb92-7ff61de5bbb7 923->924 927 7ff61de5bbea-7ff61de5bbf1 924->927 928 7ff61de5bbb9-7ff61de5bbbb 924->928 932 7ff61de5bbc6-7ff61de5bbdd call 7ff61de54f58 call 7ff61de54f78 call 7ff61de5a950 927->932 933 7ff61de5bbf3-7ff61de5bc1b call 7ff61de5d66c call 7ff61de5a9b8 * 2 927->933 930 7ff61de5bbbd-7ff61de5bbc4 928->930 931 7ff61de5bbe2-7ff61de5bbe8 928->931 930->931 930->932 935 7ff61de5bc68-7ff61de5bc7f 931->935 964 7ff61de5bd70 932->964 960 7ff61de5bc1d-7ff61de5bc33 call 7ff61de54f78 call 7ff61de54f58 933->960 961 7ff61de5bc38-7ff61de5bc63 call 7ff61de5c2f4 933->961 938 7ff61de5bcfa-7ff61de5bd04 call 7ff61de6398c 935->938 939 7ff61de5bc81-7ff61de5bc89 935->939 951 7ff61de5bd0a-7ff61de5bd1f 938->951 952 7ff61de5bd8e 938->952 939->938 943 7ff61de5bc8b-7ff61de5bc8d 939->943 943->938 948 7ff61de5bc8f-7ff61de5bca5 943->948 948->938 953 7ff61de5bca7-7ff61de5bcb3 948->953 951->952 958 7ff61de5bd21-7ff61de5bd33 GetConsoleMode 951->958 956 7ff61de5bd93-7ff61de5bdb3 ReadFile 952->956 953->938 954 7ff61de5bcb5-7ff61de5bcb7 953->954 954->938 959 7ff61de5bcb9-7ff61de5bcd1 954->959 962 7ff61de5bead-7ff61de5beb6 GetLastError 956->962 963 7ff61de5bdb9-7ff61de5bdc1 956->963 958->952 965 7ff61de5bd35-7ff61de5bd3d 958->965 959->938 967 7ff61de5bcd3-7ff61de5bcdf 959->967 960->964 961->935 972 7ff61de5beb8-7ff61de5bece call 7ff61de54f78 call 7ff61de54f58 962->972 973 7ff61de5bed3-7ff61de5bed6 962->973 963->962 969 7ff61de5bdc7 963->969 966 7ff61de5bd73-7ff61de5bd7d call 7ff61de5a9b8 964->966 965->956 971 7ff61de5bd3f-7ff61de5bd61 ReadConsoleW 965->971 966->920 967->938 975 7ff61de5bce1-7ff61de5bce3 967->975 979 7ff61de5bdce-7ff61de5bde3 969->979 981 7ff61de5bd63 GetLastError 971->981 982 7ff61de5bd82-7ff61de5bd8c 971->982 972->964 976 7ff61de5bedc-7ff61de5bede 973->976 977 7ff61de5bd69-7ff61de5bd6b call 7ff61de54eec 973->977 975->938 986 7ff61de5bce5-7ff61de5bcf5 975->986 976->966 977->964 979->966 988 7ff61de5bde5-7ff61de5bdf0 979->988 981->977 982->979 986->938 992 7ff61de5be17-7ff61de5be1f 988->992 993 7ff61de5bdf2-7ff61de5be0b call 7ff61de5b6e4 988->993 996 7ff61de5be9b-7ff61de5bea8 call 7ff61de5b524 992->996 997 7ff61de5be21-7ff61de5be33 992->997 999 7ff61de5be10-7ff61de5be12 993->999 996->999 1000 7ff61de5be35 997->1000 1001 7ff61de5be8e-7ff61de5be96 997->1001 999->966 1002 7ff61de5be3a-7ff61de5be41 1000->1002 1001->966 1004 7ff61de5be7d-7ff61de5be88 1002->1004 1005 7ff61de5be43-7ff61de5be47 1002->1005 1004->1001 1006 7ff61de5be49-7ff61de5be50 1005->1006 1007 7ff61de5be63 1005->1007 1006->1007 1008 7ff61de5be52-7ff61de5be56 1006->1008 1009 7ff61de5be69-7ff61de5be79 1007->1009 1008->1007 1010 7ff61de5be58-7ff61de5be61 1008->1010 1009->1002 1011 7ff61de5be7b 1009->1011 1010->1009 1011->1001
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                        • Instruction ID: d597bbf374f13cff36bc6f92747013d24d684438343d5ef71763537e02def977
                                                                                                                                        • Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                        • Instruction Fuzzy Hash: 23C1E62AA0CF8681EB609B1594403BF7764FB81FE2F594131EA4E83791EF7CE8558B01
                                                                                                                                        Function 00007FF61DE48760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 995526605-0
                                                                                                                                        • Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                        • Instruction ID: 06265ac443ae7015225501379bb76e9f29fde0cf89d9cc37ade76997c472b4ec
                                                                                                                                        • Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                        • Instruction Fuzzy Hash: 7A212131A0CE8282EB509B59B49422BA7A1FB85BB1F504235EA6DC3AE4EF6CD445C740
                                                                                                                                        Function 00007FF61DE490E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FF61DE48760: GetCurrentProcess.KERNEL32 ref: 00007FF61DE48780
                                                                                                                                          • Part of subcall function 00007FF61DE48760: OpenProcessToken.ADVAPI32 ref: 00007FF61DE48793
                                                                                                                                          • Part of subcall function 00007FF61DE48760: GetTokenInformation.KERNELBASE ref: 00007FF61DE487B8
                                                                                                                                          • Part of subcall function 00007FF61DE48760: GetLastError.KERNEL32 ref: 00007FF61DE487C2
                                                                                                                                          • Part of subcall function 00007FF61DE48760: GetTokenInformation.KERNELBASE ref: 00007FF61DE48802
                                                                                                                                          • Part of subcall function 00007FF61DE48760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF61DE4881E
                                                                                                                                          • Part of subcall function 00007FF61DE48760: CloseHandle.KERNEL32 ref: 00007FF61DE48836
                                                                                                                                        • LocalFree.KERNEL32(?,00007FF61DE43C55), ref: 00007FF61DE4916C
                                                                                                                                        • LocalFree.KERNEL32(?,00007FF61DE43C55), ref: 00007FF61DE49175
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                        • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                        • API String ID: 6828938-1529539262
                                                                                                                                        • Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                        • Instruction ID: df889f51d432d72c0fca5373b2c8cefe113b65357fbe13a685753ed814c02a19
                                                                                                                                        • Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                        • Instruction Fuzzy Hash: 2A215C21A08F8281F610AB10E9153EF63A1FF88BA2F854035EA4DD3796EF3DE845C740
                                                                                                                                        Function 00007FF61DE47E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • CreateDirectoryW.KERNELBASE(00000000,?,00007FF61DE4352C,?,00000000,00007FF61DE43F23), ref: 00007FF61DE47F22
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CreateDirectory
                                                                                                                                        • String ID: %.*s$%s%c$\
                                                                                                                                        • API String ID: 4241100979-1685191245
                                                                                                                                        • Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                        • Instruction ID: c7fb7ba054d02e5960efb2bc2a62857b1a93e0967b3c43403f8854fd904aeded
                                                                                                                                        • Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                        • Instruction Fuzzy Hash: 3F31D221B19EC245EA219B21E8503AB6354EF94FF5F440230EA6DC3BC9FF2CD6458780
                                                                                                                                        Function 00007FF61DE5CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DE5CFBB), ref: 00007FF61DE5D0EC
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DE5CFBB), ref: 00007FF61DE5D177
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ConsoleErrorLastMode
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 953036326-0
                                                                                                                                        • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                        • Instruction ID: 8371277c11d0c1c39004de6249a5e9886bcf6cb2b6fab99cee541c5c29bc9cda
                                                                                                                                        • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                        • Instruction Fuzzy Hash: DB91D63AF18E5195F7509F6994402BE2BA0BB44FE9F144139DE0E97A95EE3DD483C700
                                                                                                                                        Function 00007FF61DE5F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _get_daylight$_isindst
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4170891091-0
                                                                                                                                        • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                        • Instruction ID: b33375d2e0bce5e1eaf923a2bef24d9bcd21605846f1a74d7fc80f8f8ee39377
                                                                                                                                        • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                        • Instruction Fuzzy Hash: 5651F677F08A118AFB14CF2499656BE27A1AB54BBEF500135DF1DD2AE5EF38A401C700
                                                                                                                                        Function 00007FF61DE557EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2780335769-0
                                                                                                                                        • Opcode ID: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
                                                                                                                                        • Instruction ID: b2a907101e2451e7139376223b808d1055947260044901ad9c070470b99234cd
                                                                                                                                        • Opcode Fuzzy Hash: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
                                                                                                                                        • Instruction Fuzzy Hash: FD515A26E18A418AFB10DFB1D4503BE23B1AB49FA9F148439DE5DDB689EF3CE4518710
                                                                                                                                        Function 00007FF61DE55698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1279662727-0
                                                                                                                                        • Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                        • Instruction ID: 7c36126d518876e4fc44c6320ff065324226d1c8dce2f755373fe9353012999d
                                                                                                                                        • Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                        • Instruction Fuzzy Hash: 14419426E28B8283E7509F20955037E7360FB94BB5F109335E65C83AD2EF6CB5E08750
                                                                                                                                        Function 00007FF61DE4CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3251591375-0
                                                                                                                                        • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                        • Instruction ID: a94a491b7ddcc93adf3b1e1d4b555633885377ed002c8eb1360746c9cb9bf8bb
                                                                                                                                        • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                        • Instruction Fuzzy Hash: 50316C24E08E4345FE64AB2698613FB27D1AF42FAAF440435EA0EC72D3FF2DA455C201
                                                                                                                                        Function 00007FF61DE59AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                        • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                        • Instruction ID: 7c9f7c8f16c41b9f7f880143933d566baea3787a8914af92c5e93f5bb505e12f
                                                                                                                                        • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                        • Instruction Fuzzy Hash: 5ED06718B18F8652EA142B705C990BE12516F49FA2F141478D90B86393FD6DA4494310
                                                                                                                                        Function 00007FF61DE501AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                        • Instruction ID: 26e90685628bbd6f861d60cfbd1e45a6af94ca96a3a9c64557f44be6648974cf
                                                                                                                                        • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                        • Instruction Fuzzy Hash: 9151F629B09A6286E6799A26940067F6A91BF44FF6F144734FE6C877C6EF3CE4018601
                                                                                                                                        Function 00007FF61DE5C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                        • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                        • Instruction ID: 072aa5118e6e1e3c355235a3fe87ba8bb255c599725f23d930cdafd956d3ad34
                                                                                                                                        • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                        • Instruction Fuzzy Hash: E511E365718E8181DA108B25A85416E7761BB45FF5F584331EE7D8B7E9EF7CD0118700
                                                                                                                                        Function 00007FF61DE55994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DE558A9), ref: 00007FF61DE559C7
                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DE558A9), ref: 00007FF61DE559DD
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Time$System$FileLocalSpecific
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1707611234-0
                                                                                                                                        • Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                        • Instruction ID: 3867708d1d1f0653662e01acdbeee159665b4ef7b3e13efedebc2b4cc31c113a
                                                                                                                                        • Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                        • Instruction Fuzzy Hash: A1114C2261CE5282EA548F15A45113FB7A0FB85FB2F500236EAADC1AD8FF6DE054CB00
                                                                                                                                        Function 00007FF61DE5A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • RtlFreeHeap.NTDLL(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9CE
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9D8
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                        • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                        • Instruction ID: 27d6d85e30459ef1c23c5aaa4964a35c2f778a378df8502ffbf91abf67c3be25
                                                                                                                                        • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                        • Instruction Fuzzy Hash: 39E08C18F08E4282FF096BB2A84513F13906F89FA2F044034C91DC62A2FE2CB8858310
                                                                                                                                        Function 00007FF61DE5ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,00007FF61DE5AA45,?,?,00000000,00007FF61DE5AAFA), ref: 00007FF61DE5AC36
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF61DE5AA45,?,?,00000000,00007FF61DE5AAFA), ref: 00007FF61DE5AC40
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                        • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                        • Instruction ID: 8fce841485ed1fa94fe28ee403fbac6f387d1fba0f6778a0dcb94d64b644e81c
                                                                                                                                        • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                        • Instruction Fuzzy Hash: AF218119B1CF8242EF949761A49427F1682AF84FF6F084239DA2EC73D2EE6CB4459300
                                                                                                                                        Function 00007FF61DE5BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                        • Instruction ID: 110a86c5fd2440f975070306fcfaadfe7175e3f3acbdfb67957527c2785927ee
                                                                                                                                        • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                        • Instruction Fuzzy Hash: 9E41E63AA08B0187EA349B15E55027B73A4EB55FE6F140231DA8EC76D1EF2DF402CB61
                                                                                                                                        Function 00007FF61DE47F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                        • Opcode ID: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
                                                                                                                                        • Instruction ID: 8d8ead750fb9deb5d8691eee68f6b92e6cae3f758c0a3228d8e202b7da616cb5
                                                                                                                                        • Opcode Fuzzy Hash: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
                                                                                                                                        • Instruction Fuzzy Hash: A921E221B18E9286FA10AB22A5443BB9791BF45FE5F8C5430EE4DCB786EF7DE041C600
                                                                                                                                        Function 00007FF61DE5B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                        • Instruction ID: 1cede45fefbc5cfea18f20ad80a37b72713615c2664f09c31935c608750fa188
                                                                                                                                        • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                        • Instruction Fuzzy Hash: EB318F29A18E4285FB516B59984137E3650AF40FF6F424135EA2D833D2EF7DE4418B21
                                                                                                                                        Function 00007FF61DE599D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3947729631-0
                                                                                                                                        • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                        • Instruction ID: 1c6ded75ea6a4ff000642bbff6b477690eb980e3a9a2a33542c12f1625e94d21
                                                                                                                                        • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                        • Instruction Fuzzy Hash: 17218E36A04F828AEB658F64C8442ED37A0EB05B69F480639D72D86AD6EF39D584C750
                                                                                                                                        Function 00007FF61DE56004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                        • Instruction ID: a084b477103b8c2c2ff6d9bda4586d8e00fc2d8fff7aa9767ce7ac96469fd9f9
                                                                                                                                        • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                        • Instruction Fuzzy Hash: 7F11512EA1CA4182EA60AF51A40027FA364BF45FE5F544031EB4CD7E96EF3DF5408721
                                                                                                                                        Function 00007FF61DE663C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                        • Instruction ID: 0da2996c3c1f77315860f3afbf9312e08567dbbd2573e3bd2f4a53fcca5d4b7c
                                                                                                                                        • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                        • Instruction Fuzzy Hash: ED212172618E8186D7619F18D48037E76A1FB84FA5F544239E79D876D9EF3DD400CB00
                                                                                                                                        Function 00007FF61DE5042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                        • Instruction ID: 88f89054b0f493d670a83281a530279acdd3d77d4791b813a9544120a32b70c4
                                                                                                                                        • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                        • Instruction Fuzzy Hash: E501C429A08F9141EA04DF52990106BAB91BF86FF1F084631EE5C97BD6EE3CE1014300
                                                                                                                                        Function 00007FF61DE5EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapAlloc.KERNEL32(?,?,00000000,00007FF61DE5B39A,?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA), ref: 00007FF61DE5EC5D
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocHeap
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                        • Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                        • Instruction ID: 89a0b9da8b8c8523ebff23991b94797c72ea6c9e10a81dc7bb17cb37f8bfd18b
                                                                                                                                        • Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                        • Instruction Fuzzy Hash: 71F09048F09F8781FE545B6698513BB52805F89FE2F5C9430CD0ECA3D1FE1CE4808210
                                                                                                                                        Function 00007FF61DE5D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapAlloc.KERNEL32(?,?,?,00007FF61DE50D00,?,?,?,00007FF61DE5236A,?,?,?,?,?,00007FF61DE53B59), ref: 00007FF61DE5D6AA
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocHeap
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                        • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                        • Instruction ID: a56d2a2d2a2803016ae1ac0a4206fed0b8e390fd2f39b1ad449f8521ad65bf77
                                                                                                                                        • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                        • Instruction Fuzzy Hash: F6F05808B09B4284FE646B6558012BB12904F94FF2F880230DE2EC53D2FEAEE4828221

                                                                                                                                        Non-executed Functions

                                                                                                                                        Function 00007FF61DE476B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                        • API String ID: 199729137-3427451314
                                                                                                                                        • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                        • Instruction ID: f4ede1072d9359693e5881bc41a206d12e3941bf2d2cf6c8eac5c949504cdf62
                                                                                                                                        • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                        • Instruction Fuzzy Hash: 4202C520A4DF87D0FE55AB5AA8145BB27A5AF04F77F851131DA1EC2260FF3CB588D290
                                                                                                                                        Function 00007FF61DE6411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                        • API String ID: 808467561-2761157908
                                                                                                                                        • Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                        • Instruction ID: 6bdf7700b3498fc83e26d1e635ac048da71e8c8b29f7c4457c0f27a090897c65
                                                                                                                                        • Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                        • Instruction Fuzzy Hash: E1B2B572B1CAD28BE7658E64D4407FE37A2FB54B99F505135DB0D97A88EF38A900CB40
                                                                                                                                        Function 00007FF61DE4AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                        • API String ID: 0-2665694366
                                                                                                                                        • Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                        • Instruction ID: 8a0d8ac9b487228afcef9a6def831d7395b686b5325dfc9cd669785a00f24414
                                                                                                                                        • Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                        • Instruction Fuzzy Hash: 6752C572A14AA68BEB948F14D458B7F3BA9FB44766F014139E64AC7780EF3CD844CB40
                                                                                                                                        Function 00007FF61DE4D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3140674995-0
                                                                                                                                        • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                        • Instruction ID: 3594992e6d6b0f5206d4d04089281ecea5d428a5d351373ff16de7a10a3e0396
                                                                                                                                        • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                        • Instruction Fuzzy Hash: 23311972608E8186EB609F65E8803EF73A4FB84B55F44443ADB4E87B95EF38D548C714
                                                                                                                                        Function 00007FF61DE5A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1239891234-0
                                                                                                                                        • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                        • Instruction ID: d2668e5f183a3f3be8cc1e5912975236035be92f5a6f311840052f6acf0f88b2
                                                                                                                                        • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                        • Instruction Fuzzy Hash: 96314D36618F8186DB608F25E8402AF73A4FB88B69F540135EA9D87B55EF3CD1458B00
                                                                                                                                        Function 00007FF61DE618E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2227656907-0
                                                                                                                                        • Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                        • Instruction ID: a3fbd5561356c52bc1b1c33b599aa15eb03255136a80f68cb0d1144e972b2cdc
                                                                                                                                        • Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                        • Instruction Fuzzy Hash: B3B19326B1CED681EA629B21A5041BF6791EB45FF6F445231EB5D87B89FE3CE441C300
                                                                                                                                        Function 00007FF61DE4D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                        • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                        • Instruction ID: fa75c3ae3f142c872814304d90d1b638b5f85250289149e90fc651ad55c43989
                                                                                                                                        • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                        • Instruction Fuzzy Hash: 9D112E26B14F068AEF40CF60E8552BE33A4FB19B69F440E31DA6D867A4EF7CD5558380
                                                                                                                                        Function 00007FF61DE63C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy_s
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1502251526-0
                                                                                                                                        • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                        • Instruction ID: e5825dfad55341b73cb0086922e0292801c2c66019009d994ef26bd3df48d4b0
                                                                                                                                        • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                        • Instruction Fuzzy Hash: 3FC1C272B1CAC687EB248F19A04466EB7A1F794F95F459135DB4A83B84EF3DE801CB40
                                                                                                                                        Function 00007FF61DE4A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                        • API String ID: 0-1127688429
                                                                                                                                        • Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                        • Instruction ID: 1d2b573d5e8809e9bf99e9595205d149fb5128309bdad8b0f04f86a1555c70cb
                                                                                                                                        • Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                        • Instruction Fuzzy Hash: 78F18262A18BD54BE7A58F19C488B3B3BA9EF44B69F064538DA4DC7790EF38E540C740
                                                                                                                                        Function 00007FF61DE69798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionRaise_clrfp
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 15204871-0
                                                                                                                                        • Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                        • Instruction ID: e834dcaeacb2f9137a81bdc2ce0adab39f4cea953c3996cf5807e77a59e1aab6
                                                                                                                                        • Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                        • Instruction Fuzzy Hash: 2FB12677A04B898AEB15CF29C8463AD3BA0F784F69F188921DB5D877A8DF39D451C700
                                                                                                                                        Function 00007FF61DE53A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: $
                                                                                                                                        • API String ID: 0-227171996
                                                                                                                                        • Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                        • Instruction ID: b978bebcf189a62ca78c6975d3ab98c6b4e384b18f66203134c22fe7e4362efb
                                                                                                                                        • Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                        • Instruction Fuzzy Hash: 50E1953AA08E4686EB688F25815013E73A0FF45FEAF145235DA4E87795FF3AE851C740
                                                                                                                                        Function 00007FF61DE4A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: incorrect header check$invalid window size
                                                                                                                                        • API String ID: 0-900081337
                                                                                                                                        • Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                        • Instruction ID: 7fa209b6aa17dc24c3f869d820563dc24624430abc576a8a2a90d3954844d0fd
                                                                                                                                        • Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                        • Instruction Fuzzy Hash: 4F918472A18AC687EBA58E14D458B3F3AA9FB44765F114139DB4EC6780EF3CE540CB40
                                                                                                                                        Function 00007FF61DE5DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: e+000$gfff
                                                                                                                                        • API String ID: 0-3030954782
                                                                                                                                        • Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                        • Instruction ID: daed1ae0048022585393ae654d90b7911e7ba805a3ad46075ab7a1a967f774f1
                                                                                                                                        • Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                        • Instruction Fuzzy Hash: 2D515966B18AC186E7248E35990076E6791E744FE4F48C231CB9C87AC5EF3EE441C700
                                                                                                                                        Function 00007FF61DE60938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1010374628-0
                                                                                                                                        • Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                        • Instruction ID: 878c32f9e23a03fba20f863fc36c2e0ba2c61610179bdf53c51213a6811ccb9e
                                                                                                                                        • Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                        • Instruction Fuzzy Hash: 03027E21A1DEB641FA65AB21A45127F2AA0AF45FF2F458635EE5DC63D2FE3DB4018300
                                                                                                                                        Function 00007FF61DE5DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: gfffffff
                                                                                                                                        • API String ID: 0-1523873471
                                                                                                                                        • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                        • Instruction ID: ce88a7bcf1ae52e53ee758119aab2ee4a8ae7966bf867f7cb700b6a61f756d47
                                                                                                                                        • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                        • Instruction Fuzzy Hash: DFA14867A08BC586EB21CF29A4007AE7B91EB64BE5F058131DE4D87785EE3ED502C701
                                                                                                                                        Function 00007FF61DE58804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID: TMP
                                                                                                                                        • API String ID: 3215553584-3125297090
                                                                                                                                        • Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                        • Instruction ID: 49a653ed5b578019d707e55be088d4e6e5eff19c2f365a74902dc4d979df3e17
                                                                                                                                        • Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                        • Instruction Fuzzy Hash: E951C019F08F4241FA68AB26599117F6691AF86FE6F884135DE4EC77D6FE3CF4028201
                                                                                                                                        Function 00007FF61DE634F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: HeapProcess
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 54951025-0
                                                                                                                                        • Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                        • Instruction ID: 3bb6ebf5eaa5789436d2ff94e3de8fac250ff19248e7e0c42c05f9891c0d60ad
                                                                                                                                        • Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                        • Instruction Fuzzy Hash: B4B09220E07E42C2EE082B21AC8221A22A47F48B22F980138C11CC0330EE2C20E56700
                                                                                                                                        Function 00007FF61DE53610 Relevance: .3, Instructions: 327COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                        • Instruction ID: 3b49311f98729090c1376780cf97810c4c66c216c504bf3d5d212d19caff494c
                                                                                                                                        • Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                        • Instruction Fuzzy Hash: ADD1B16AE08E4386EB68CE29845027F27A0EB45FE9F144239CE0D877D5EF39E855C750
                                                                                                                                        Function 00007FF61DE49870 Relevance: .3, Instructions: 287COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                        • Instruction ID: d380ec64661ee3fdb7fa23d6e4bc12da1296b846498fb017395a3ba1fc1c1011
                                                                                                                                        • Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                        • Instruction Fuzzy Hash: ECC1A0762181E08BD289EB29E87947A73D1F78930EB95406BEF87877C5CB3CA514DB10
                                                                                                                                        Function 00007FF61DE52C80 Relevance: .2, Instructions: 241COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                        • Instruction ID: 353b26406ba8c664a48eb0eafe0f82c2178428776b62d2570c868ff90cd88dca
                                                                                                                                        • Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                        • Instruction Fuzzy Hash: F6B19E3AA08B85C5E7658F39D09023E3BA0F749FA9F280135EA4D97395EF39D451C750
                                                                                                                                        Function 00007FF61DE5E5E0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                        • Instruction ID: 511ceec2f5bbd9011508834fa4242c783838e0cc136cedfa10c682556773a1b4
                                                                                                                                        • Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                        • Instruction Fuzzy Hash: D581C276A08B8286E774CF19A54037B7A91FB45FE5F548235DA9D83B99EF3DE4008B00
                                                                                                                                        Function 00007FF61DE66488 Relevance: .2, Instructions: 183COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
                                                                                                                                        • Instruction ID: ce4a2c0774a6c0fdb72981ae6f408b36bb9c7d4c1d9bf824d41f382737757688
                                                                                                                                        • Opcode Fuzzy Hash: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
                                                                                                                                        • Instruction Fuzzy Hash: 4761E122E28AD246FB648A28945523F7680AF41B72F54467DDB1DC66D5FE7DE800CF00
                                                                                                                                        Function 00007FF61DE51DC4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                        • Instruction ID: efbd2049b0f9038525b1f23a7db7a3230f3851a06e76a8a3590cfd230db77fc4
                                                                                                                                        • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                        • Instruction Fuzzy Hash: 7651753AA18E5286E7248B29D04423E37A1EB45FB9F244331DE4D97794EF3AE853C740
                                                                                                                                        Function 00007FF61DE521D4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                        • Instruction ID: 8f349d7109f9f22ce8a1d0a6c6ba936d49aaf240e4beb1008f694c15eb7ab31b
                                                                                                                                        • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                        • Instruction Fuzzy Hash: 94518A3EA18E5281E7258B29C08023A37A0EB54FB9F644131DE4D9B7D4EF3AE843C740
                                                                                                                                        Function 00007FF61DE519B4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                        • Instruction ID: f2dd4b6ed6bf37a1d11e440c801405907dfd6d3e948d30086143e62b811e9e09
                                                                                                                                        • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                        • Instruction Fuzzy Hash: C351637AA18E5186EB658B29C04423A37A0EB45FBDF244231CA4D97795FF3AE853C740
                                                                                                                                        Function 00007FF61DE51FD0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                        • Instruction ID: 12945a5893b2fe99690e00293e7e56f29f84de1535a9251789f1f2811c4b438f
                                                                                                                                        • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                        • Instruction Fuzzy Hash: 5851993AA19E5185E7248B29C48033E37A0EB54FA9F244131EE4D977A5EF3AEC43C740
                                                                                                                                        Function 00007FF61DE517B0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                        • Instruction ID: 1fcf764e3ad2b53373237acbadd1378b875b1fae56c425b610b27b1be4d50860
                                                                                                                                        • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                        • Instruction Fuzzy Hash: 4751613AA18E5186E7758F29D04023E37A1EB45FA9F245271CE4D97794EF3AE842C740
                                                                                                                                        Function 00007FF61DE51BC0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                        • Instruction ID: 1dad0d7d1dca72f029fcb9d8c4e734f030b01127f0f5bf2ff1944dc98f16e829
                                                                                                                                        • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                        • Instruction Fuzzy Hash: 3D51793AA18E5585E7688B29C04433E37A1EB45FAAF244231CE4D97795DF3BE843C740
                                                                                                                                        Function 00007FF61DE55DA0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                        • Instruction ID: 65053ff597e90534cca0f960e253ede123a729f29d83e806a4cfbb51688d4e51
                                                                                                                                        • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                        • Instruction Fuzzy Hash: BD41B66EC09F4A84E9A5CD2809046BE66809F63FF2D5852B0DDA9D37C3FE0C39968211
                                                                                                                                        Function 00007FF61DE59F10 Relevance: .1, Instructions: 126COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                        • Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                        • Instruction ID: ab63dc1408748562b60027be78201e9dcd0a79933c5b7b0d363ad7cb78540938
                                                                                                                                        • Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                        • Instruction Fuzzy Hash: 6441F426724F5582EF44CF2ADA141AAB3A1FB49FE4B099436DE0DD7B58EE3CD4428300
                                                                                                                                        Function 00007FF61DE58154 Relevance: .1, Instructions: 98COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                        • Instruction ID: a622c9ad8197bb17c56cabd1ed1ae71f94af28d09012efaef5e07c9b7eec317a
                                                                                                                                        • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                        • Instruction Fuzzy Hash: 6F31A436B18F9282E764DB25A48013F6A95AB85FE1F144239EA5D93BD6EF3CD1028704
                                                                                                                                        Function 00007FF61DE695E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                        • Instruction ID: 2f1ab18f1abddb8eaaeedba5f0b1db3a26cb9d4b3467c6a738a36a6c33dfe2c8
                                                                                                                                        • Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                        • Instruction Fuzzy Hash: 24F068717186958ADB998F69A80262A77D0F7087D1F808039D69DC3B24DE3CD0619F04
                                                                                                                                        Function 00007FF61DE4D37C Relevance: .0, Instructions: 2COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                        • Instruction ID: 46da0617531b644c5dc471eb74473592811ad85b50b967df483f784c98e9d178
                                                                                                                                        • Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                        • Instruction Fuzzy Hash: 22A00221A0CC4AD1EA458F04E8A007B2374FB50B22F400071E11DC10B0BF3DA400D300
                                                                                                                                        Function 00007FF61DE45820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45830
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45842
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45879
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE4588B
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE458A4
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE458B6
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE458CF
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE458E1
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE458FD
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE4590F
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE4592B
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE4593D
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45959
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE4596B
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45987
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE45999
                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE459B5
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE464BF,?,00007FF61DE4336E), ref: 00007FF61DE459C7
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                        • API String ID: 199729137-653951865
                                                                                                                                        • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                        • Instruction ID: 3b3061b4c014fe9a06b1beb2844b1fc3ddfe5c2ece2ac6774d0a17aaaaab1fd2
                                                                                                                                        • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                        • Instruction Fuzzy Hash: 0922A424E0DF87D1FE959B56A8141BB27A4AF09F77F845036DA2EC2660FF3CB5589200
                                                                                                                                        Function 00007FF61DE481C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FF61DE49400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61DE445E4,00000000,00007FF61DE41985), ref: 00007FF61DE49439
                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00007FF61DE488A7,?,?,00000000,00007FF61DE43CBB), ref: 00007FF61DE4821C
                                                                                                                                          • Part of subcall function 00007FF61DE42810: MessageBoxW.USER32 ref: 00007FF61DE428EA
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                        • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                        • API String ID: 1662231829-930877121
                                                                                                                                        • Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                        • Instruction ID: 362e785dd4281c5db79bd5002ff8b12bd29f5fd199ff0d271c532e197240c005
                                                                                                                                        • Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                        • Instruction Fuzzy Hash: 9D518421A1CE8291FB51AB25E8916BF6391AF94FA2F844431EA0EC66D5FF2CE505C740
                                                                                                                                        Function 00007FF61DE42180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                        • String ID: P%
                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                        • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                        • Instruction ID: f4a927b47918ed97983ef2ef777e827d9c2ae56a609013cfa4a932c2bf3f9f08
                                                                                                                                        • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                        • Instruction Fuzzy Hash: 4851D626614BA186DA249F26A4581BBB7A1F798B72F004125EBDE83694EF3CD085DB10
                                                                                                                                        Function 00007FF61DE480B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                        • String ID: Needs to remove its temporary files.
                                                                                                                                        • API String ID: 3975851968-2863640275
                                                                                                                                        • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                        • Instruction ID: b2249cb1cb81a384b9e858e195aa1a6adbf4c0c78d535bcd303fcbad435005b3
                                                                                                                                        • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                        • Instruction Fuzzy Hash: FF214121B19E8282EB554B7AA89417E6351EF88FB2F584231DB2DC7395FF2CD591C201
                                                                                                                                        Function 00007FF61DE56300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID: -$:$f$p$p
                                                                                                                                        • API String ID: 3215553584-2013873522
                                                                                                                                        • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                        • Instruction ID: fd95ad9732d4faa1a69756ab72289935ca1b0afbc41698d93eef2425465f07c6
                                                                                                                                        • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                        • Instruction Fuzzy Hash: 31127F6AE0894386FB605B14F15427B77A1FB40FA6F844539E68A866D4EF7CE980CF10
                                                                                                                                        Function 00007FF61DE51038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID: f$f$p$p$f
                                                                                                                                        • API String ID: 3215553584-1325933183
                                                                                                                                        • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                        • Instruction ID: 0dab8e9e9e4435a9fc68051212deb56967f4e368693d3792689af88e54c8d57d
                                                                                                                                        • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                        • Instruction Fuzzy Hash: D712942AE0C94386FB209A15E05467B7661FB50FE6FC84235E699C7AC4EF7CE4809B50
                                                                                                                                        Function 00007FF61DE41050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                        • Opcode ID: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
                                                                                                                                        • Instruction ID: 717704b519b1a145aeb9dbca25287bcc92ffec87827343d82454a258ac9bb533
                                                                                                                                        • Opcode Fuzzy Hash: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
                                                                                                                                        • Instruction Fuzzy Hash: CD416B25B08AA282EE10DB16E8406BB6394BF44FE6F544532EE4DC7796FF3CE5058740
                                                                                                                                        Function 00007FF61DE41470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                        • Opcode ID: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
                                                                                                                                        • Instruction ID: 22c11e32826470f4654d2bbbd96a9e760ecdc82b35620d59b0794cf65665409f
                                                                                                                                        • Opcode Fuzzy Hash: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
                                                                                                                                        • Instruction Fuzzy Hash: 48414A26B08A9295EE10DB21A4405FB7390AF44FA5F444632EE5DC7B99FF3CE5028744
                                                                                                                                        Function 00007FF61DE4EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                        • API String ID: 849930591-393685449
                                                                                                                                        • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                        • Instruction ID: e27a9876ab9a87165309436b9a80f12642209304b67ab3c672834088d23072ea
                                                                                                                                        • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                        • Instruction Fuzzy Hash: 23D15D32A0CF418AEB209B6594413AE77A0FB55FA9F100135EE4DD7B9AEF38E591C701
                                                                                                                                        Function 00007FF61DE42C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42C9E
                                                                                                                                        • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42D63
                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF61DE42D99
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Message$CurrentFormatProcess
                                                                                                                                        • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                        • API String ID: 3940978338-251083826
                                                                                                                                        • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                        • Instruction ID: 02b7979ab1f9bbefa1231b674b31802898d877fa72de1902635d2eea23160524
                                                                                                                                        • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                        • Instruction Fuzzy Hash: D231D622B08F4142EA209B25A8442AB6795BF88FEAF410135EF4DD3759FF3CD506C300
                                                                                                                                        Function 00007FF61DE4DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF61DE4DFEA,?,?,?,00007FF61DE4DCDC,?,?,?,00007FF61DE4D8D9), ref: 00007FF61DE4DDBD
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF61DE4DFEA,?,?,?,00007FF61DE4DCDC,?,?,?,00007FF61DE4D8D9), ref: 00007FF61DE4DDCB
                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF61DE4DFEA,?,?,?,00007FF61DE4DCDC,?,?,?,00007FF61DE4D8D9), ref: 00007FF61DE4DDF5
                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF61DE4DFEA,?,?,?,00007FF61DE4DCDC,?,?,?,00007FF61DE4D8D9), ref: 00007FF61DE4DE63
                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF61DE4DFEA,?,?,?,00007FF61DE4DCDC,?,?,?,00007FF61DE4D8D9), ref: 00007FF61DE4DE6F
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                        • String ID: api-ms-
                                                                                                                                        • API String ID: 2559590344-2084034818
                                                                                                                                        • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                        • Instruction ID: b0e2f44a9d9822e05d877430b434b226d02a975946552013624b9df53845fb4f
                                                                                                                                        • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                        • Instruction Fuzzy Hash: CA317C21B1AE4291EE629B1AA80057B2394FF58FB2F594635EE2DC7380FF3DE4458310
                                                                                                                                        Function 00007FF61DE46350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                        • API String ID: 2050909247-2434346643
                                                                                                                                        • Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                        • Instruction ID: 257bd3d8306cb598088b913045bf854abea20bfab49c50b446cfd75a1f915626
                                                                                                                                        • Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                        • Instruction Fuzzy Hash: 07415E31A18EC791EA11DB20E4542EB6361FF54BA6F804136EA5DC3696FF3CE615C740
                                                                                                                                        Function 00007FF61DE42A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF61DE4351A,?,00000000,00007FF61DE43F23), ref: 00007FF61DE42AA0
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                        • API String ID: 2050909247-2900015858
                                                                                                                                        • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                        • Instruction ID: 305e4b58459541353ece0b885e8b730182a7f5afa0c9bb7aa5e5478c1db875b0
                                                                                                                                        • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                        • Instruction Fuzzy Hash: 3C215172B19B8192EA20DB51B8817EB6394FB88BE5F400136EE8DD3659EF3CD645C740
                                                                                                                                        Function 00007FF61DE5B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                        • Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                        • Instruction ID: 3e9581d457ae847f37e991e550d0b4563125613e2d1b80a437977d3f1f1f76c5
                                                                                                                                        • Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                        • Instruction Fuzzy Hash: 61215B2CE0CE4682FAA8A761565223F62425F44FF2F144734E93EC7AD6FE2CB4018710
                                                                                                                                        Function 00007FF61DE67DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                        • String ID: CONOUT$
                                                                                                                                        • API String ID: 3230265001-3130406586
                                                                                                                                        • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                        • Instruction ID: 9345c4f78fce8132ae80e61edab2d71b97ea9b5ac0961cee1a207c57e197ce2d
                                                                                                                                        • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                        • Instruction Fuzzy Hash: E3115E21B18E8286EB509B52F85432E67A0FB98FF6F044234EA5DC77A4EF7CD8448740
                                                                                                                                        Function 00007FF61DE48560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF61DE49216), ref: 00007FF61DE48592
                                                                                                                                        • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF61DE49216), ref: 00007FF61DE485E9
                                                                                                                                          • Part of subcall function 00007FF61DE49400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61DE445E4,00000000,00007FF61DE41985), ref: 00007FF61DE49439
                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF61DE49216), ref: 00007FF61DE48678
                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF61DE49216), ref: 00007FF61DE486E4
                                                                                                                                        • FreeLibrary.KERNEL32(?,?,00000000,00007FF61DE49216), ref: 00007FF61DE486F5
                                                                                                                                        • FreeLibrary.KERNEL32(?,?,00000000,00007FF61DE49216), ref: 00007FF61DE4870A
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3462794448-0
                                                                                                                                        • Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                        • Instruction ID: c5bbce372b39bf111735e4cf0d2364c1bba4a91c2f0ee42078f14c367a35b5f5
                                                                                                                                        • Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                        • Instruction Fuzzy Hash: 7141A026B19A8241EA709B12A5946AB6394FB84FE6F444035DF8DD7B89FF3CE401C710
                                                                                                                                        Function 00007FF61DE5B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B347
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B37D
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B3AA
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B3BB
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B3CC
                                                                                                                                        • SetLastError.KERNEL32(?,?,?,00007FF61DE54F81,?,?,?,?,00007FF61DE5A4FA,?,?,?,?,00007FF61DE571FF), ref: 00007FF61DE5B3E7
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                        • Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                        • Instruction ID: f029b7a46814e57e05924abc664fd974ecce1f4fc3eeb947239e9d8e0c03e942
                                                                                                                                        • Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                        • Instruction Fuzzy Hash: 43116D29A0DE4282FA95A721565123F62425F44FF2F144734E97ED77D6FE6CB4018701
                                                                                                                                        Function 00007FF61DE42910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF61DE41B6A), ref: 00007FF61DE4295E
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                        • API String ID: 2050909247-2962405886
                                                                                                                                        • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                        • Instruction ID: 5cbe623257372c94a9137f01414e5970f2664138e32fe203b02ba1287e19387d
                                                                                                                                        • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                        • Instruction Fuzzy Hash: F431B626B18E8152EB109761A8416EB6795BF89BE5F410132EE8DC3755FF3CD546C700
                                                                                                                                        Function 00007FF61DE42390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                        • String ID: Unhandled exception in script
                                                                                                                                        • API String ID: 3081866767-2699770090
                                                                                                                                        • Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                        • Instruction ID: 77f371698b2247aa0302e1c71eb703c99f41b0c49fe40f693c74a1bc5802ba91
                                                                                                                                        • Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                        • Instruction Fuzzy Hash: D2314076A19A8289EB20DF61E8552FB63A0FF89BA5F440135EA4D87B59EF3CD1058700
                                                                                                                                        Function 00007FF61DE42B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF61DE4918F,?,00007FF61DE43C55), ref: 00007FF61DE42BA0
                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF61DE42C2A
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentMessageProcess
                                                                                                                                        • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                        • API String ID: 1672936522-3797743490
                                                                                                                                        • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                        • Instruction ID: 62e88ffdc11fe4d6f56ff67fcae8a7b31f76f9db18e7612c641f4cfe24244868
                                                                                                                                        • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                        • Instruction Fuzzy Hash: CB219F62708B8192E6109B14B8847AB73A4EB88BD5F404136EA8DD7655EF3CD605C740
                                                                                                                                        Function 00007FF61DE42710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF61DE41B99), ref: 00007FF61DE42760
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                        • API String ID: 2050909247-1591803126
                                                                                                                                        • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                        • Instruction ID: fb03bc987387dfbdb30a116e59f8c70b8984ef8dac249953f1fb04666d706957
                                                                                                                                        • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                        • Instruction Fuzzy Hash: 54218E72B18B8192EA20DB51B8817EB63A4FB88BE5F400135FE8CC3659EF3CD6458740
                                                                                                                                        Function 00007FF61DE59AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                        • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                        • Instruction ID: 60e6b1e810536df04c6013266127de7d33f1278cb22e3f3f6a48a45db2649748
                                                                                                                                        • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                        • Instruction Fuzzy Hash: 54F04F25B09E4691FE508B24E89577B6320EF45FB6F540235CA6E861E4FF2CD0448344
                                                                                                                                        Function 00007FF61DE693D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _set_statfp
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1156100317-0
                                                                                                                                        • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                        • Instruction ID: 0d0fddfce9701dffc3d76af5bc8152be32e43c4a1841028586a558d55460e093
                                                                                                                                        • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                        • Instruction Fuzzy Hash: BF115172E5CE9301FA541124DCD63FF2055EF59B76F044634EB6EC66DAEE2CA9414104
                                                                                                                                        Function 00007FF61DE5B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • FlsGetValue.KERNEL32(?,?,?,00007FF61DE5A613,?,?,00000000,00007FF61DE5A8AE,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5B41F
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE5A613,?,?,00000000,00007FF61DE5A8AE,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5B43E
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE5A613,?,?,00000000,00007FF61DE5A8AE,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5B466
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE5A613,?,?,00000000,00007FF61DE5A8AE,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5B477
                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF61DE5A613,?,?,00000000,00007FF61DE5A8AE,?,?,?,?,?,00007FF61DE5A83A), ref: 00007FF61DE5B488
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Value
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                        • Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                        • Instruction ID: 4291cc25d7c55a4824374f609370a010a9e34bf461f320d832c866cbea81244f
                                                                                                                                        • Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                        • Instruction Fuzzy Hash: 39115B29F0CE5241FEA8A725A65227B61525F84FF2F488334E97EC66D6FE2CF4418700
                                                                                                                                        Function 00007FF61DE5B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Value
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                        • Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                        • Instruction ID: e6f3d398b786ae99203353b8745022c0e42990f71abc271b19957f132c0d0412
                                                                                                                                        • Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                        • Instruction Fuzzy Hash: 4D11E528E0DA0785FEA9A325545227F21425F46FB2F584734D93EDA2D2FD2CB4418751
                                                                                                                                        Function 00007FF61DE56010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID: verbose
                                                                                                                                        • API String ID: 3215553584-579935070
                                                                                                                                        • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                        • Instruction ID: 2a1594d0d2a5a2ef41a9d0ca47208baaf39df361c400860c661fe2ed65714090
                                                                                                                                        • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                        • Instruction Fuzzy Hash: B3919D2AA08E4681F7618F25E55037E33A1AB45FE6F44423ADA8D873D5EE3CE845CB01
                                                                                                                                        Function 00007FF61DE5FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                        • API String ID: 3215553584-1196891531
                                                                                                                                        • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                        • Instruction ID: 9d8f44638c7d4384d03abc4ce18059551c361b4d66a72fb9a4e8d5804a445e44
                                                                                                                                        • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                        • Instruction Fuzzy Hash: D481B03BE08A42C5FB645E29811037F36A0AB11FFAF558035DA0AD769AFF2DE9119341
                                                                                                                                        Function 00007FF61DE4D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                        • String ID: csm
                                                                                                                                        • API String ID: 2395640692-1018135373
                                                                                                                                        • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                        • Instruction ID: 5f5f61481eb62f23d87e7e84c8c563d56bce80c76ec048de43db2070b0cb3326
                                                                                                                                        • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                        • Instruction Fuzzy Hash: 2B51A032B19A028AEB549F19E444A7A7791EB48FA9F158135DA4EC7748FF3EE841C700
                                                                                                                                        Function 00007FF61DE4EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CallEncodePointerTranslator
                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                        • API String ID: 3544855599-2084237596
                                                                                                                                        • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                        • Instruction ID: 751d71c5268ea7971c561c05612f01ad06955923bea384a3669bbf330065c30b
                                                                                                                                        • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                        • Instruction Fuzzy Hash: 4A616133908BC585E7609B15E4447AAB7A0FB85FA9F044225EB9D87B55EF7CE190CB00
                                                                                                                                        Function 00007FF61DE4F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                        • String ID: csm$csm
                                                                                                                                        • API String ID: 3896166516-3733052814
                                                                                                                                        • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                        • Instruction ID: 5c93c6c0198c173e44e6899d98189523396f75edbdfd7224f960ffc7345944d3
                                                                                                                                        • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                        • Instruction Fuzzy Hash: AF519133908A828AEB648F25905836A77A0FB54FA6F145235EA5DC7B95EF3CE850C701
                                                                                                                                        Function 00007FF61DE42810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Message
                                                                                                                                        • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                        • API String ID: 2030045667-255084403
                                                                                                                                        • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                        • Instruction ID: 184afb426da971fa0ef5edb3bcae1e364bbb58b33063079225c4dbeddd227c86
                                                                                                                                        • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                        • Instruction Fuzzy Hash: 2D219F62B18B8192E6109B14B4447AB73A4EB88B95F400136EA8DD7656EF3CD645C740
                                                                                                                                        Function 00007FF61DE5C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2718003287-0
                                                                                                                                        • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                        • Instruction ID: ebc0c5e0569995c62fbb0ed9bae1bcdd07345897ea46c4d8daa29ae0bcd7a9fc
                                                                                                                                        • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                        • Instruction Fuzzy Hash: 6ED12576B18E818AEB11CF75D4501AD3BB1FB45BE9B048235DE5E97B8AEE38D016C340
                                                                                                                                        Function 00007FF61DE420C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1956198572-0
                                                                                                                                        • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                        • Instruction ID: 9470241775097b2f55fd4a770e977ea0802d440579b53c90c0ff81d8de972276
                                                                                                                                        • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                        • Instruction Fuzzy Hash: 5911CC21F1C98242FA549B6AE58437F5392EF94FA1F448031DB49C7B9AEE3DD4D58200
                                                                                                                                        Function 00007FF61DE65B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                        • String ID: ?
                                                                                                                                        • API String ID: 1286766494-1684325040
                                                                                                                                        • Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                        • Instruction ID: 60956a70406e866c8b66ca4b20fe088657ae2275e72a58b732e309eae193c1ac
                                                                                                                                        • Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                        • Instruction Fuzzy Hash: 7241C122B18BC246FB649B25A44537F66A0EB91FB6F144235EF5C86AD5FE3CE441C700
                                                                                                                                        Function 00007FF61DE59084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DE590B6
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9CE
                                                                                                                                          • Part of subcall function 00007FF61DE5A9B8: GetLastError.KERNEL32(?,?,?,00007FF61DE62D92,?,?,?,00007FF61DE62DCF,?,?,00000000,00007FF61DE63295,?,?,?,00007FF61DE631C7), ref: 00007FF61DE5A9D8
                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF61DE4CC15), ref: 00007FF61DE590D4
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                        • String ID: C:\Users\user\Desktop\Ao8sixO8Om.exe
                                                                                                                                        • API String ID: 3580290477-1047595440
                                                                                                                                        • Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                        • Instruction ID: 3e70a801cad211b3005c4bbbe9c21d37a8add0a60e9e660544d131bd9be4a1ba
                                                                                                                                        • Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                        • Instruction Fuzzy Hash: 5C41843AA08F5285EB14DF25A9800FF6794EF49FE1B555035EA4D83B85EE3DE4818340
                                                                                                                                        Function 00007FF61DE5CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileLastWrite
                                                                                                                                        • String ID: U
                                                                                                                                        • API String ID: 442123175-4171548499
                                                                                                                                        • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                        • Instruction ID: fc5c617458751873147f55fe245f9e66e65390f40a4da0cb51cbee43b3ba2a65
                                                                                                                                        • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                        • Instruction Fuzzy Hash: 0E418032B18A8585DB608F26E4543AA7BA0FB98BE5F844135EE4DC7B98EF3CD451C740
                                                                                                                                        Function 00007FF61DE5F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentDirectory
                                                                                                                                        • String ID: :
                                                                                                                                        • API String ID: 1611563598-336475711
                                                                                                                                        • Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                        • Instruction ID: 432a3ee290c3ed2c8966fa0355b37bd3bfe1644ad2ea9ee3639579cf33e0b5d6
                                                                                                                                        • Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                        • Instruction Fuzzy Hash: E221B467A08A8282FB209B15D05426F73B1FB84F95F958035DA8D83694EFBCE9458B81
                                                                                                                                        Function 00007FF61DE4FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFileHeaderRaise
                                                                                                                                        • String ID: csm
                                                                                                                                        • API String ID: 2573137834-1018135373
                                                                                                                                        • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                        • Instruction ID: 692e0759150882957427f4141f51ab869ec399e536672e85ff1c13373f8e2f11
                                                                                                                                        • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                        • Instruction Fuzzy Hash: 2C110732618B8182EB618F15E44426AB7E4FB88FA9F584230DB8D87769EF3CD5518B00
                                                                                                                                        Function 00007FF61DE607AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1573220089.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000000.00000002.1573181876.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573274714.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573310603.00007FF61DE82000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000000.00000002.1573403928.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                        • String ID: :
                                                                                                                                        • API String ID: 2595371189-336475711
                                                                                                                                        • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                        • Instruction ID: 79ff3e8d166ae0e0159d4ff80d8a96fa54a4be7a402f19e8310c9b45e57a80c9
                                                                                                                                        • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                        • Instruction Fuzzy Hash: DF018426A18A5385F720AF60A46527F37A0EF45B69F801035D65DC6691FF2CE5048A24

                                                                                                                                        Executed Functions

                                                                                                                                        Function 00007FFBBB421220 Relevance: 673.2, APIs: 191, Strings: 193, Instructions: 1225networkCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Module_$Constant$ObjectString$Err_$DeallocExceptionFrom$Capsule_ExitFormatLongLong_MallocMem_MetaclassStartupTypeType_Unsigned
                                                                                                                                        • String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
                                                                                                                                        • API String ID: 585143114-1188461360
                                                                                                                                        • Opcode ID: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
                                                                                                                                        • Instruction ID: 5085b0bfae13520496b46a6356a7e95a1c8333c9425366dd60f966fe36fa308d
                                                                                                                                        • Opcode Fuzzy Hash: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
                                                                                                                                        • Instruction Fuzzy Hash: 3BC2A3A1F28F5791FA008B3EE8542A53764BF45BC0F84D135CB0A86674EE6DE249E31C
                                                                                                                                        Function 00007FF61DE41000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 263 7ff61de41000-7ff61de43806 call 7ff61de4fe88 call 7ff61de4fe90 call 7ff61de4c8c0 call 7ff61de55460 call 7ff61de554f4 call 7ff61de436b0 277 7ff61de43808-7ff61de4380f 263->277 278 7ff61de43814-7ff61de43836 call 7ff61de41950 263->278 279 7ff61de43c97-7ff61de43cb2 call 7ff61de4c5c0 277->279 283 7ff61de4383c-7ff61de43856 call 7ff61de41c80 278->283 284 7ff61de4391b-7ff61de43931 call 7ff61de445b0 278->284 288 7ff61de4385b-7ff61de4389b call 7ff61de48a20 283->288 291 7ff61de4396a-7ff61de4397f call 7ff61de42710 284->291 292 7ff61de43933-7ff61de43960 call 7ff61de47f80 284->292 298 7ff61de4389d-7ff61de438a3 288->298 299 7ff61de438c1-7ff61de438cc call 7ff61de54fa0 288->299 302 7ff61de43c8f 291->302 300 7ff61de43984-7ff61de439a6 call 7ff61de41c80 292->300 301 7ff61de43962-7ff61de43965 call 7ff61de500bc 292->301 303 7ff61de438af-7ff61de438bd call 7ff61de48b90 298->303 304 7ff61de438a5-7ff61de438ad 298->304 310 7ff61de439fc-7ff61de43a2a call 7ff61de48b30 call 7ff61de48b90 * 3 299->310 311 7ff61de438d2-7ff61de438e1 call 7ff61de48a20 299->311 316 7ff61de439b0-7ff61de439b9 300->316 301->291 302->279 303->299 304->303 339 7ff61de43a2f-7ff61de43a3e call 7ff61de48a20 310->339 320 7ff61de438e7-7ff61de438ed 311->320 321 7ff61de439f4-7ff61de439f7 call 7ff61de54fa0 311->321 316->316 319 7ff61de439bb-7ff61de439d8 call 7ff61de41950 316->319 319->288 331 7ff61de439de-7ff61de439ef call 7ff61de42710 319->331 325 7ff61de438f0-7ff61de438fc 320->325 321->310 328 7ff61de438fe-7ff61de43903 325->328 329 7ff61de43905-7ff61de43908 325->329 328->325 328->329 329->321 332 7ff61de4390e-7ff61de43916 call 7ff61de54fa0 329->332 331->302 332->339 342 7ff61de43b45-7ff61de43b53 339->342 343 7ff61de43a44-7ff61de43a47 339->343 344 7ff61de43b59-7ff61de43b5d 342->344 345 7ff61de43a67 342->345 343->342 346 7ff61de43a4d-7ff61de43a50 343->346 347 7ff61de43a6b-7ff61de43a90 call 7ff61de54fa0 344->347 345->347 348 7ff61de43a56-7ff61de43a5a 346->348 349 7ff61de43b14-7ff61de43b17 346->349 358 7ff61de43aab-7ff61de43ac0 347->358 359 7ff61de43a92-7ff61de43aa6 call 7ff61de48b30 347->359 348->349 350 7ff61de43a60 348->350 351 7ff61de43b19-7ff61de43b1d 349->351 352 7ff61de43b2f-7ff61de43b40 call 7ff61de42710 349->352 350->345 351->352 354 7ff61de43b1f-7ff61de43b2a 351->354 360 7ff61de43c7f-7ff61de43c87 352->360 354->347 362 7ff61de43be8-7ff61de43bfa call 7ff61de48a20 358->362 363 7ff61de43ac6-7ff61de43aca 358->363 359->358 360->302 371 7ff61de43bfc-7ff61de43c02 362->371 372 7ff61de43c2e 362->372 365 7ff61de43bcd-7ff61de43be2 call 7ff61de41940 363->365 366 7ff61de43ad0-7ff61de43ae8 call 7ff61de552c0 363->366 365->362 365->363 376 7ff61de43aea-7ff61de43b02 call 7ff61de552c0 366->376 377 7ff61de43b62-7ff61de43b7a call 7ff61de552c0 366->377 374 7ff61de43c1e-7ff61de43c2c 371->374 375 7ff61de43c04-7ff61de43c1c 371->375 378 7ff61de43c31-7ff61de43c40 call 7ff61de54fa0 372->378 374->378 375->378 376->365 389 7ff61de43b08-7ff61de43b0f 376->389 387 7ff61de43b87-7ff61de43b9f call 7ff61de552c0 377->387 388 7ff61de43b7c-7ff61de43b80 377->388 385 7ff61de43c46-7ff61de43c4a 378->385 386 7ff61de43d41-7ff61de43d63 call 7ff61de444d0 378->386 390 7ff61de43c50-7ff61de43c5f call 7ff61de490e0 385->390 391 7ff61de43cd4-7ff61de43ce6 call 7ff61de48a20 385->391 400 7ff61de43d71-7ff61de43d82 call 7ff61de41c80 386->400 401 7ff61de43d65-7ff61de43d6f call 7ff61de44620 386->401 402 7ff61de43bac-7ff61de43bc4 call 7ff61de552c0 387->402 403 7ff61de43ba1-7ff61de43ba5 387->403 388->387 389->365 405 7ff61de43c61 390->405 406 7ff61de43cb3-7ff61de43cbd call 7ff61de48850 390->406 407 7ff61de43ce8-7ff61de43ceb 391->407 408 7ff61de43d35-7ff61de43d3c 391->408 415 7ff61de43d87-7ff61de43d96 400->415 401->415 402->365 418 7ff61de43bc6 402->418 403->402 412 7ff61de43c68 call 7ff61de42710 405->412 424 7ff61de43cc8-7ff61de43ccf 406->424 425 7ff61de43cbf-7ff61de43cc6 406->425 407->408 413 7ff61de43ced-7ff61de43d10 call 7ff61de41c80 407->413 408->412 426 7ff61de43c6d-7ff61de43c77 412->426 430 7ff61de43d2b-7ff61de43d33 call 7ff61de54fa0 413->430 431 7ff61de43d12-7ff61de43d26 call 7ff61de42710 call 7ff61de54fa0 413->431 421 7ff61de43d98-7ff61de43d9f 415->421 422 7ff61de43dc4-7ff61de43dda call 7ff61de49400 415->422 418->365 421->422 428 7ff61de43da1-7ff61de43da5 421->428 434 7ff61de43de8-7ff61de43e04 SetDllDirectoryW 422->434 435 7ff61de43ddc 422->435 424->415 425->412 426->360 428->422 432 7ff61de43da7-7ff61de43dbe SetDllDirectoryW LoadLibraryExW 428->432 430->415 431->426 432->422 438 7ff61de43e0a-7ff61de43e19 call 7ff61de48a20 434->438 439 7ff61de43f01-7ff61de43f08 434->439 435->434 452 7ff61de43e1b-7ff61de43e21 438->452 453 7ff61de43e32-7ff61de43e3c call 7ff61de54fa0 438->453 441 7ff61de43ffc-7ff61de44004 439->441 442 7ff61de43f0e-7ff61de43f15 439->442 446 7ff61de44029-7ff61de4403e call 7ff61de436a0 call 7ff61de43360 call 7ff61de43670 441->446 447 7ff61de44006-7ff61de44023 PostMessageW GetMessageW 441->447 442->441 445 7ff61de43f1b-7ff61de43f25 call 7ff61de433c0 442->445 445->426 459 7ff61de43f2b-7ff61de43f3f call 7ff61de490c0 445->459 474 7ff61de44043-7ff61de4405b call 7ff61de46fb0 call 7ff61de46d60 446->474 447->446 456 7ff61de43e2d-7ff61de43e2f 452->456 457 7ff61de43e23-7ff61de43e2b 452->457 464 7ff61de43ef2-7ff61de43efc call 7ff61de48b30 453->464 465 7ff61de43e42-7ff61de43e48 453->465 456->453 457->456 472 7ff61de43f41-7ff61de43f5e PostMessageW GetMessageW 459->472 473 7ff61de43f64-7ff61de43fa7 call 7ff61de48b30 call 7ff61de48bd0 call 7ff61de46fb0 call 7ff61de46d60 call 7ff61de48ad0 459->473 464->439 465->464 469 7ff61de43e4e-7ff61de43e54 465->469 470 7ff61de43e56-7ff61de43e58 469->470 471 7ff61de43e5f-7ff61de43e61 469->471 475 7ff61de43e67-7ff61de43e83 call 7ff61de46db0 call 7ff61de47330 470->475 476 7ff61de43e5a 470->476 471->439 471->475 472->473 511 7ff61de43fe9-7ff61de43ff7 call 7ff61de41900 473->511 512 7ff61de43fa9-7ff61de43fb3 call 7ff61de49200 473->512 490 7ff61de43e8e-7ff61de43e95 475->490 491 7ff61de43e85-7ff61de43e8c 475->491 476->439 494 7ff61de43e97-7ff61de43ea4 call 7ff61de46df0 490->494 495 7ff61de43eaf-7ff61de43eb9 call 7ff61de471a0 490->495 493 7ff61de43edb-7ff61de43ef0 call 7ff61de42a50 call 7ff61de46fb0 call 7ff61de46d60 491->493 493->439 494->495 509 7ff61de43ea6-7ff61de43ead 494->509 505 7ff61de43ebb-7ff61de43ec2 495->505 506 7ff61de43ec4-7ff61de43ed2 call 7ff61de474e0 495->506 505->493 506->439 519 7ff61de43ed4 506->519 509->493 511->426 512->511 522 7ff61de43fb5-7ff61de43fca 512->522 519->493 523 7ff61de43fcc-7ff61de43fdf call 7ff61de42710 call 7ff61de41900 522->523 524 7ff61de43fe4 call 7ff61de42a50 522->524 523->426 524->511
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                        • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                        • API String ID: 2776309574-4232158417
                                                                                                                                        • Opcode ID: d02545141998fec8b25848ae1ed1df906e7abc4b971c3e4ab34b798fb2006b6e
                                                                                                                                        • Instruction ID: d72b116952b01620a26ea5361fca08cb2b460b6537ecd962040bfebb9601c786
                                                                                                                                        • Opcode Fuzzy Hash: d02545141998fec8b25848ae1ed1df906e7abc4b971c3e4ab34b798fb2006b6e
                                                                                                                                        • Instruction Fuzzy Hash: A5328C21E4CE8291FB29EB2195543BB67A1AF44FA6F844036DA5DC32D6FF2CE554C310
                                                                                                                                        Function 00007FF61DE669D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 933 7ff61de669d4-7ff61de66a47 call 7ff61de66708 936 7ff61de66a49-7ff61de66a52 call 7ff61de54f58 933->936 937 7ff61de66a61-7ff61de66a6b call 7ff61de58590 933->937 942 7ff61de66a55-7ff61de66a5c call 7ff61de54f78 936->942 943 7ff61de66a6d-7ff61de66a84 call 7ff61de54f58 call 7ff61de54f78 937->943 944 7ff61de66a86-7ff61de66aef CreateFileW 937->944 957 7ff61de66da2-7ff61de66dc2 942->957 943->942 945 7ff61de66b6c-7ff61de66b77 GetFileType 944->945 946 7ff61de66af1-7ff61de66af7 944->946 952 7ff61de66bca-7ff61de66bd1 945->952 953 7ff61de66b79-7ff61de66bb4 GetLastError call 7ff61de54eec CloseHandle 945->953 949 7ff61de66b39-7ff61de66b67 GetLastError call 7ff61de54eec 946->949 950 7ff61de66af9-7ff61de66afd 946->950 949->942 950->949 955 7ff61de66aff-7ff61de66b37 CreateFileW 950->955 960 7ff61de66bd9-7ff61de66bdc 952->960 961 7ff61de66bd3-7ff61de66bd7 952->961 953->942 968 7ff61de66bba-7ff61de66bc5 call 7ff61de54f78 953->968 955->945 955->949 962 7ff61de66be2-7ff61de66c37 call 7ff61de584a8 960->962 963 7ff61de66bde 960->963 961->962 971 7ff61de66c56-7ff61de66c87 call 7ff61de66488 962->971 972 7ff61de66c39-7ff61de66c45 call 7ff61de66910 962->972 963->962 968->942 979 7ff61de66c8d-7ff61de66ccf 971->979 980 7ff61de66c89-7ff61de66c8b 971->980 972->971 978 7ff61de66c47 972->978 983 7ff61de66c49-7ff61de66c51 call 7ff61de5ab30 978->983 981 7ff61de66cf1-7ff61de66cfc 979->981 982 7ff61de66cd1-7ff61de66cd5 979->982 980->983 985 7ff61de66d02-7ff61de66d06 981->985 986 7ff61de66da0 981->986 982->981 984 7ff61de66cd7-7ff61de66cec 982->984 983->957 984->981 985->986 988 7ff61de66d0c-7ff61de66d51 CloseHandle CreateFileW 985->988 986->957 990 7ff61de66d86-7ff61de66d9b 988->990 991 7ff61de66d53-7ff61de66d81 GetLastError call 7ff61de54eec call 7ff61de586d0 988->991 990->986 991->990
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1617910340-0
                                                                                                                                        • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                        • Instruction ID: b8cf468e86b654d00b84d2f347ae2e55ad735c6760b3df97905e3a04ab7590bb
                                                                                                                                        • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                        • Instruction Fuzzy Hash: 49C1BF36B28E8185EB10DF69C4902AE3761FB49FA9F015229DF2E97795EF38E451C700
                                                                                                                                        Function 00007FF61DE492F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                        • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                        • Instruction ID: 52469781c954ed7385c7acbc4b10fa027c4dfb2036f7bea9ee693902d9fb728e
                                                                                                                                        • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                        • Instruction Fuzzy Hash: 61F06D22618B4187F7608F50B45976B7350BB45B79F440335DA6D826D4EF3CD4598600
                                                                                                                                        Function 00007FFBBB426260 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: recv
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1507349165-0
                                                                                                                                        • Opcode ID: 99e5f51573d728835275b842b7b463659f533cb3bd81800f4d5850c3710a3088
                                                                                                                                        • Instruction ID: 248fc7bb9e7bd91ce51a9a2518a3b4ee85722a8e859fd631a68e5560f7e4e563
                                                                                                                                        • Opcode Fuzzy Hash: 99e5f51573d728835275b842b7b463659f533cb3bd81800f4d5850c3710a3088
                                                                                                                                        • Instruction Fuzzy Hash: 63E04FF2A20A8582DB149B66E4402647360F719FB4F249731CA3C1B3E0DE38D4E1C750
                                                                                                                                        Function 00007FFBAB723D10 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • GetSystemInfo.KERNEL32 ref: 00007FFBAB723D19
                                                                                                                                          • Part of subcall function 00007FFBAB7247B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBAB7396B0), ref: 00007FFBAB7247D0
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: InfoSystemabort
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2206927444-0
                                                                                                                                        • Opcode ID: b0dacfb730800d666d93919dbbe9ab600f84794237231edeb61f47d85ffef636
                                                                                                                                        • Instruction ID: 1943d48d36dc8601a604dc0f05d5a6dea5aee2cc0dd016499ca2db82e14295b5
                                                                                                                                        • Opcode Fuzzy Hash: b0dacfb730800d666d93919dbbe9ab600f84794237231edeb61f47d85ffef636
                                                                                                                                        • Instruction Fuzzy Hash: 83E012B4E2A98282E612FB30F90217533E6BB54710F808930D9AD427B5DEFCE5458A00
                                                                                                                                        Function 00007FFBAB7EAB50 Relevance: 89.5, APIs: 30, Strings: 21, Instructions: 211stringmemorythreadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 214 7ffbab7eab50-7ffbab7eab64 PySys_GetObject 215 7ffbab7eab6a-7ffbab7eab78 214->215 216 7ffbab7eaf0d-7ffbab7eaf3c PyErr_Format 214->216 215->216 217 7ffbab7eab7e-7ffbab7eab9f PyUnicode_AsUTF8 strncmp 215->217 217->216 218 7ffbab7eaba5-7ffbab7eabd6 PyModule_Create2 217->218 219 7ffbab7eaf09-7ffbab7eaf0b 218->219 220 7ffbab7eabdc-7ffbab7eabe4 218->220 221 7ffbab7eaed0-7ffbab7eaeed 219->221 222 7ffbab7eabe6-7ffbab7eabf6 PyDict_New 220->222 223 7ffbab7eabfc-7ffbab7eac0f 220->223 222->219 222->223 224 7ffbab7eac78-7ffbab7eac7f 223->224 225 7ffbab7eac11 223->225 227 7ffbab7eac81-7ffbab7eac91 PyUnicode_FromString 224->227 228 7ffbab7eacf2-7ffbab7ead0c PyCapsule_New 224->228 226 7ffbab7eac13-7ffbab7eac2c strncmp 225->226 229 7ffbab7eac32-7ffbab7eac3d PyType_Ready 226->229 230 7ffbab7eaeee-7ffbab7eaf03 PyErr_Format 226->230 227->219 231 7ffbab7eac97-7ffbab7eacb0 PyDict_SetItemString 227->231 228->219 232 7ffbab7ead12-7ffbab7ead27 PyModule_AddObject 228->232 229->219 234 7ffbab7eac43-7ffbab7eac48 229->234 230->219 231->219 235 7ffbab7eacb6-7ffbab7eacc6 PyUnicode_FromString 231->235 232->219 233 7ffbab7ead2d-7ffbab7ead3d PyUnicode_FromString 232->233 233->219 236 7ffbab7ead43-7ffbab7ead58 PyModule_AddObject 233->236 237 7ffbab7eac4a 234->237 238 7ffbab7eac4c-7ffbab7eac62 PyModule_AddObject 234->238 235->219 239 7ffbab7eaccc-7ffbab7eace5 PyDict_SetItemString 235->239 236->219 240 7ffbab7ead5e-7ffbab7ead76 PyModule_AddIntConstant 236->240 237->238 238->219 241 7ffbab7eac68-7ffbab7eac76 238->241 239->219 242 7ffbab7eaceb 239->242 240->219 243 7ffbab7ead7c-7ffbab7ead94 PyModule_AddIntConstant 240->243 241->224 241->226 242->228 243->219 244 7ffbab7ead9a-7ffbab7eadb2 PyModule_AddIntConstant 243->244 244->219 245 7ffbab7eadb8-7ffbab7eadc2 244->245 246 7ffbab7eae03-7ffbab7eae0a 245->246 247 7ffbab7eadc4-7ffbab7eadc7 245->247 249 7ffbab7eae34-7ffbab7eae3d PyErr_Occurred 246->249 250 7ffbab7eae0c-7ffbab7eae1b TlsAlloc 246->250 248 7ffbab7eadd0-7ffbab7eade6 PyModule_AddIntConstant 247->248 248->219 251 7ffbab7eadec-7ffbab7eae01 248->251 249->219 253 7ffbab7eae43-7ffbab7eae68 PyThread_allocate_lock 249->253 250->249 252 7ffbab7eae1d-7ffbab7eae2e PyErr_SetString 250->252 251->246 251->248 252->249 254 7ffbab7eae6a-7ffbab7eae7b PyErr_SetString 253->254 255 7ffbab7eae81-7ffbab7eae8a PyErr_Occurred 253->255 254->255 255->219 256 7ffbab7eae8c-7ffbab7eae93 call 7ffbab7ea3d0 255->256 256->219 259 7ffbab7eae95-7ffbab7eae9d 256->259 260 7ffbab7eae9f-7ffbab7eaeaf PyImport_ImportModule 259->260 261 7ffbab7eaecd 259->261 260->219 262 7ffbab7eaeb1-7ffbab7eaecb PyObject_GetAttrString 260->262 261->221 262->219 262->261
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567140268.00007FFBAB7D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAB7D0000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567092485.00007FFBAB7D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567171367.00007FFBAB7ED000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567208958.00007FFBAB7FA000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567260853.00007FFBAB7FF000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567299695.00007FFBAB800000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab7d0000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Module_String$Err_$ConstantObjectUnicode_$Dict_From$FormatItemOccurredstrncmp$AllocAttrCapsule_Create2ImportImport_ModuleObject_ReadySys_Thread_allocate_lockType_
                                                                                                                                        • String ID: '%s' is an ill-formed type name$1$1.16.0$3.12.0b2$<cdata>$FFI_CDECL$FFI_DEFAULT_ABI$TlsAlloc() failed$_C_API$_IOBase$_WIN$__module__$__name__$__version__$_cffi_backend$_cffi_backend.$_io$can't allocate cffi_zombie_lock$cffi$this module was compiled for Python %c%c%c$version
                                                                                                                                        • API String ID: 3385652222-906895635
                                                                                                                                        • Opcode ID: 41d2292e8d75c2ca34776530f0312aae3a7164146f4ab80ae338a68818af90c6
                                                                                                                                        • Instruction ID: 855ec582ae8d1d89214ce150e479c4e18322d11c53ffd2c7768c0eeb14c5a21c
                                                                                                                                        • Opcode Fuzzy Hash: 41d2292e8d75c2ca34776530f0312aae3a7164146f4ab80ae338a68818af90c6
                                                                                                                                        • Instruction Fuzzy Hash: 13B1D6E0A0BA4391FA16DB35E89427427A0BF45F89F44C036CD2E4B674EFACE559C316
                                                                                                                                        Function 00007FFBAB7E7B10 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 193threadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 530 7ffbab7e7b10-7ffbab7e7b56 _PyArg_ParseTupleAndKeywords_SizeT 531 7ffbab7e7b58-7ffbab7e7b5f 530->531 532 7ffbab7e7bc3-7ffbab7e7bd2 530->532 533 7ffbab7e7b73-7ffbab7e7b87 PyDict_GetItem 531->533 534 7ffbab7e7b61-7ffbab7e7b6d PyDict_New 531->534 536 7ffbab7e7c55-7ffbab7e7c5e 533->536 537 7ffbab7e7b8d-7ffbab7e7b99 PyThread_allocate_lock 533->537 534->532 535 7ffbab7e7b6f 534->535 535->533 538 7ffbab7e7c60 536->538 539 7ffbab7e7c62-7ffbab7e7c6d 536->539 537->532 540 7ffbab7e7b9b-7ffbab7e7bb8 PyCapsule_New 537->540 538->539 541 7ffbab7e7c80-7ffbab7e7c96 PyCapsule_GetPointer 539->541 542 7ffbab7e7c6f-7ffbab7e7c7f 539->542 543 7ffbab7e7bba-7ffbab7e7bbd PyThread_free_lock 540->543 544 7ffbab7e7bd3-7ffbab7e7bee PyTuple_Pack 540->544 545 7ffbab7e7c98-7ffbab7e7c9a 541->545 546 7ffbab7e7cc3-7ffbab7e7cf4 PyEval_SaveThread PyThread_acquire_lock PyEval_RestoreThread PyDict_GetItem 541->546 543->532 547 7ffbab7e7bf0-7ffbab7e7bf4 544->547 548 7ffbab7e7bff-7ffbab7e7c02 544->548 545->532 549 7ffbab7e7ca0-7ffbab7e7ca4 545->549 551 7ffbab7e7d19-7ffbab7e7d31 _PyObject_CallFunction_SizeT 546->551 552 7ffbab7e7cf6-7ffbab7e7d01 546->552 547->548 550 7ffbab7e7bf6-7ffbab7e7bf9 _Py_Dealloc 547->550 548->532 553 7ffbab7e7c04-7ffbab7e7c2b _PyObject_CallMethod_SizeT 548->553 549->532 556 7ffbab7e7caa-7ffbab7e7cc2 _Py_Dealloc 549->556 550->548 554 7ffbab7e7d33-7ffbab7e7d53 PyTuple_Pack 551->554 555 7ffbab7e7d9e-7ffbab7e7daa PyThread_release_lock 551->555 552->551 557 7ffbab7e7d03-7ffbab7e7d0c 552->557 558 7ffbab7e7c3c-7ffbab7e7c3f 553->558 559 7ffbab7e7c2d-7ffbab7e7c31 553->559 563 7ffbab7e7d6a-7ffbab7e7d6d 554->563 564 7ffbab7e7d55-7ffbab7e7d68 PyDict_SetItem 554->564 565 7ffbab7e7dac-7ffbab7e7db0 555->565 566 7ffbab7e7dbb-7ffbab7e7dcb 555->566 557->555 560 7ffbab7e7d12-7ffbab7e7d14 557->560 558->532 562 7ffbab7e7c41-7ffbab7e7c44 558->562 559->558 561 7ffbab7e7c33-7ffbab7e7c36 _Py_Dealloc 559->561 560->555 561->558 562->536 567 7ffbab7e7c46-7ffbab7e7c4a 562->567 569 7ffbab7e7d6f-7ffbab7e7d73 563->569 570 7ffbab7e7d7e-7ffbab7e7d83 563->570 564->563 568 7ffbab7e7d85-7ffbab7e7d88 564->568 565->566 571 7ffbab7e7db2-7ffbab7e7db5 _Py_Dealloc 565->571 567->536 572 7ffbab7e7c4c-7ffbab7e7c4f _Py_Dealloc 567->572 574 7ffbab7e7d99 568->574 575 7ffbab7e7d8a-7ffbab7e7d8e 568->575 569->570 573 7ffbab7e7d75-7ffbab7e7d78 _Py_Dealloc 569->573 570->568 570->574 571->566 572->536 573->570 574->555 575->574 576 7ffbab7e7d90-7ffbab7e7d93 _Py_Dealloc 575->576 576->574
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567140268.00007FFBAB7D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAB7D0000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567092485.00007FFBAB7D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567171367.00007FFBAB7ED000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567208958.00007FFBAB7FA000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567260853.00007FFBAB7FF000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567299695.00007FFBAB800000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab7d0000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dealloc$Dict_$ItemSize$CallCapsule_Eval_Object_PackThreadTuple_$Arg_Function_Keywords_Method_ParsePointerRestoreSaveThread_acquire_lockThread_allocate_lockThread_free_lockThread_release_lockTuple
                                                                                                                                        • String ID: cffi_init_once_lock$setdefault
                                                                                                                                        • API String ID: 1006512166-1600032183
                                                                                                                                        • Opcode ID: 858341202127efa7cab02a066397fc3ede4a404ace3f3f566402af7514c105a9
                                                                                                                                        • Instruction ID: f6c41c8c2879bfab5b0b4ba25a73d3c9c30d795306e15eeed4211b7b02a0efdb
                                                                                                                                        • Opcode Fuzzy Hash: 858341202127efa7cab02a066397fc3ede4a404ace3f3f566402af7514c105a9
                                                                                                                                        • Instruction Fuzzy Hash: 4581FDB5A0BB0285EB16CF76E94427823A5AF48F94F488031DE2D467B5EFBCE455C702
                                                                                                                                        Function 00007FFBBB425AB0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234threadnetworkCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 577 7ffbbb425ab0-7ffbbb425b01 PyType_GetModuleByDef 578 7ffbbb425b0f-7ffbbb425b34 PySys_Audit 577->578 579 7ffbbb425b03-7ffbbb425b0d 577->579 581 7ffbbb425b36-7ffbbb425b39 578->581 582 7ffbbb425b8a 578->582 579->578 580 7ffbbb425b4f-7ffbbb425b5d 579->580 583 7ffbbb425d22-7ffbbb425d32 PyLong_AsLongLong 580->583 584 7ffbbb425b63-7ffbbb425b6b 580->584 586 7ffbbb425b3f-7ffbbb425b49 581->586 587 7ffbbb425dfa-7ffbbb425e5d PyEval_SaveThread WSASocketW PyEval_RestoreThread 581->587 585 7ffbbb425b8f-7ffbbb425bb2 call 7ffbbb422a50 582->585 590 7ffbbb425d5f-7ffbbb425d8e memset getsockname 583->590 591 7ffbbb425d34-7ffbbb425d3d PyErr_Occurred 583->591 588 7ffbbb425b6d-7ffbbb425b84 PyErr_Format 584->588 589 7ffbbb425bb3-7ffbbb425bbc 584->589 586->580 586->587 593 7ffbbb425cd4-7ffbbb425cd9 call 7ffbbb424a3c 587->593 594 7ffbbb425e63-7ffbbb425e81 call 7ffbbb4243c8 587->594 588->582 599 7ffbbb425bc4-7ffbbb425c15 589->599 596 7ffbbb425d9c-7ffbbb425d9f 590->596 597 7ffbbb425d90-7ffbbb425d93 590->597 591->582 595 7ffbbb425d43-7ffbbb425d5a PyErr_SetString 591->595 593->582 608 7ffbbb425cf8-7ffbbb425d01 closesocket 594->608 609 7ffbbb425e87-7ffbbb425e89 594->609 595->582 596->593 605 7ffbbb425da5-7ffbbb425db0 WSAGetLastError 596->605 603 7ffbbb425db6-7ffbbb425dba 597->603 604 7ffbbb425d95-7ffbbb425d9a 597->604 599->599 606 7ffbbb425c17-7ffbbb425c8a PySys_Audit 599->606 611 7ffbbb425dbc-7ffbbb425dea getsockopt 603->611 612 7ffbbb425df5-7ffbbb425df8 603->612 604->603 605->593 605->603 606->582 610 7ffbbb425c90-7ffbbb425cd2 PyEval_SaveThread WSASocketW PyEval_RestoreThread 606->610 608->582 609->585 610->593 613 7ffbbb425cde-7ffbbb425cee SetHandleInformation 610->613 611->593 614 7ffbbb425df0 611->614 612->594 615 7ffbbb425cf0-7ffbbb425cf2 PyErr_SetFromWindowsErr 613->615 616 7ffbbb425d06-7ffbbb425d1d 613->616 614->612 615->608 616->594
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
                                                                                                                                        • String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
                                                                                                                                        • API String ID: 3363282672-2881308447
                                                                                                                                        • Opcode ID: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
                                                                                                                                        • Instruction ID: b4a165e82ece6be86c7d4486bef9af80fc499b08062d27df826e2fa96755a49c
                                                                                                                                        • Opcode Fuzzy Hash: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
                                                                                                                                        • Instruction Fuzzy Hash: 67B16FA6E28E8582E6208B3DD8042B97760FB99BA4F04D335DF5D536B1EF3CE5849704
                                                                                                                                        Function 00007FFBBB424C0C Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 170threadstringCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 617 7ffbbb424c0c-7ffbbb424c3a 618 7ffbbb424c40-7ffbbb424ca2 PyEval_SaveThread getaddrinfo PyEval_RestoreThread 617->618 619 7ffbbb424d31-7ffbbb424d42 strcmp 617->619 622 7ffbbb424e28-7ffbbb424e38 call 7ffbbb424a70 618->622 623 7ffbbb424ca8-7ffbbb424cb3 618->623 620 7ffbbb424e82-7ffbbb424e8d 619->620 621 7ffbbb424d48-7ffbbb424d59 strcmp 619->621 626 7ffbbb424e9b-7ffbbb424ea0 620->626 627 7ffbbb424e8f 620->627 621->620 625 7ffbbb424d5f-7ffbbb424d6e 621->625 645 7ffbbb424e3d-7ffbbb424e6a memcpy freeaddrinfo 622->645 628 7ffbbb424ceb 623->628 629 7ffbbb424cb5-7ffbbb424cb8 623->629 632 7ffbbb424d70-7ffbbb424d86 inet_pton 625->632 633 7ffbbb424d95-7ffbbb424d99 625->633 634 7ffbbb424ea7 626->634 627->626 630 7ffbbb424cf0-7ffbbb424cf5 628->630 635 7ffbbb424ce4-7ffbbb424ce9 629->635 636 7ffbbb424cba-7ffbbb424cc3 freeaddrinfo 629->636 637 7ffbbb424cf7-7ffbbb424d07 freeaddrinfo 630->637 638 7ffbbb424d09-7ffbbb424d2c memcpy freeaddrinfo 630->638 639 7ffbbb424d90-7ffbbb424d93 632->639 640 7ffbbb424d88-7ffbbb424d8b 632->640 641 7ffbbb424d9b-7ffbbb424dac strchr 633->641 642 7ffbbb424de0-7ffbbb424e24 PyEval_SaveThread getaddrinfo PyEval_RestoreThread 633->642 643 7ffbbb424eac-7ffbbb424ec5 634->643 635->630 644 7ffbbb424cca-7ffbbb424cdf PyErr_SetString 636->644 637->644 638->643 639->633 639->641 640->634 641->642 646 7ffbbb424dae-7ffbbb424dd1 inet_pton 641->646 642->645 647 7ffbbb424e26 642->647 644->643 645->634 648 7ffbbb424e6c-7ffbbb424e70 645->648 646->642 649 7ffbbb424dd3 646->649 647->622 650 7ffbbb424dd6-7ffbbb424ddb 648->650 651 7ffbbb424e76 648->651 649->650 650->643 651->620
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Threadfreeaddrinfo$RestoreSavegetaddrinfoinet_ptonmemcpystrcmp$Err_Stringstrchr
                                                                                                                                        • String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
                                                                                                                                        • API String ID: 535957624-1715193308
                                                                                                                                        • Opcode ID: 3e1fadc93af86178a50d3d60021f601abebfc86c63a0e854bf59a6fc3dcfe964
                                                                                                                                        • Instruction ID: b7067bd019da161ff5dfa23b3aa652d3d7c051bab62cc0b899ddd78655d67b49
                                                                                                                                        • Opcode Fuzzy Hash: 3e1fadc93af86178a50d3d60021f601abebfc86c63a0e854bf59a6fc3dcfe964
                                                                                                                                        • Instruction Fuzzy Hash: F1716DA1A28E4286F6648F3AE40427973A0FF88B84F508636DF4D436B5DF3CE595D748
                                                                                                                                        Function 00007FFBBB425144 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114networkthreadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 652 7ffbbb425144-7ffbbb425178 653 7ffbbb42517b-7ffbbb42517e 652->653 654 7ffbbb425190-7ffbbb425193 653->654 655 7ffbbb425180-7ffbbb425188 653->655 658 7ffbbb425195-7ffbbb4251a1 _PyDeadline_Get 654->658 659 7ffbbb4251b7-7ffbbb4251c6 _PyDeadline_Init 654->659 656 7ffbbb42518e 655->656 657 7ffbbb42522f-7ffbbb42523d PyEval_SaveThread 655->657 660 7ffbbb4251c9 656->660 692 7ffbbb425240 call 7ffbbb426840 657->692 693 7ffbbb425240 call 7ffbbb426260 657->693 661 7ffbbb4251cc-7ffbbb4251dc call 7ffbbb42454c 658->661 662 7ffbbb4251a3-7ffbbb4251a6 658->662 659->660 660->661 670 7ffbbb4251e1-7ffbbb4251e4 661->670 664 7ffbbb4251ac-7ffbbb4251b2 662->664 665 7ffbbb4252c0-7ffbbb4252d1 PyErr_SetString 662->665 663 7ffbbb425244-7ffbbb425251 PyEval_RestoreThread 667 7ffbbb4252b1-7ffbbb4252b4 663->667 668 7ffbbb425253-7ffbbb425256 663->668 669 7ffbbb4252d7 664->669 665->669 671 7ffbbb4252bc-7ffbbb4252be 667->671 672 7ffbbb4252b6 667->672 673 7ffbbb425260-7ffbbb42526b WSAGetLastError 668->673 674 7ffbbb425258-7ffbbb42525e WSAGetLastError 668->674 675 7ffbbb4252dc-7ffbbb4252ea 669->675 676 7ffbbb425226-7ffbbb425229 670->676 677 7ffbbb4251e6-7ffbbb4251e9 670->677 671->675 672->671 678 7ffbbb42526d-7ffbbb425275 PyErr_CheckSignals 673->678 679 7ffbbb425279-7ffbbb42527e 673->679 674->673 676->657 676->662 680 7ffbbb4251eb-7ffbbb4251f1 WSAGetLastError 677->680 681 7ffbbb4251f3-7ffbbb4251fe WSAGetLastError 677->681 678->657 682 7ffbbb425277 678->682 683 7ffbbb425280-7ffbbb42528f WSAGetLastError 679->683 684 7ffbbb4252a7-7ffbbb4252aa 679->684 680->681 685 7ffbbb4252ac-7ffbbb4252af 681->685 686 7ffbbb425204-7ffbbb42520c PyErr_CheckSignals 681->686 687 7ffbbb425212-7ffbbb425215 682->687 683->653 688 7ffbbb425295-7ffbbb4252a0 WSAGetLastError 683->688 684->669 684->685 685->669 686->653 686->687 687->669 689 7ffbbb42521b-7ffbbb425221 687->689 688->684 691 7ffbbb4252a2 688->691 689->669 691->653 692->663 693->663
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
                                                                                                                                        • String ID: timed out
                                                                                                                                        • API String ID: 497267021-3163636755
                                                                                                                                        • Opcode ID: 8048b4ae316fdf912cb11b0f3ce4ab9d7ecbb7bf006f07ec21ad1d61a967340c
                                                                                                                                        • Instruction ID: a8bedf4dff3cb62065be70f676d00be6cb51618fefc994bc40175dfc6e7d8716
                                                                                                                                        • Opcode Fuzzy Hash: 8048b4ae316fdf912cb11b0f3ce4ab9d7ecbb7bf006f07ec21ad1d61a967340c
                                                                                                                                        • Instruction Fuzzy Hash: AD419DB1E29E4682FA255B7DE4443793290BF54B64F14C530CF4D826F4CF3CE885AA2A
                                                                                                                                        Function 00007FFBBB4229A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 74COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
                                                                                                                                        • String ID: socket.gethostname
                                                                                                                                        • API String ID: 1075394898-2650736202
                                                                                                                                        • Opcode ID: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
                                                                                                                                        • Instruction ID: 722e352de0b8005aa162f1f74e8ebd57ab2265184237aab52bfeb92d1f859ebb
                                                                                                                                        • Opcode Fuzzy Hash: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
                                                                                                                                        • Instruction Fuzzy Hash: 473136A1B2CE4686F7249B39E81427AB365FF88B85F448435DB4E426B4DF3CE444E608
                                                                                                                                        Function 00007FF61DE41950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 711 7ff61de41950-7ff61de4198b call 7ff61de445b0 714 7ff61de41991-7ff61de419d1 call 7ff61de47f80 711->714 715 7ff61de41c4e-7ff61de41c72 call 7ff61de4c5c0 711->715 720 7ff61de419d7-7ff61de419e7 call 7ff61de50744 714->720 721 7ff61de41c3b-7ff61de41c3e call 7ff61de500bc 714->721 726 7ff61de419e9-7ff61de41a03 call 7ff61de54f78 call 7ff61de42910 720->726 727 7ff61de41a08-7ff61de41a24 call 7ff61de5040c 720->727 725 7ff61de41c43-7ff61de41c4b 721->725 725->715 726->721 733 7ff61de41a26-7ff61de41a40 call 7ff61de54f78 call 7ff61de42910 727->733 734 7ff61de41a45-7ff61de41a5a call 7ff61de54f98 727->734 733->721 740 7ff61de41a5c-7ff61de41a76 call 7ff61de54f78 call 7ff61de42910 734->740 741 7ff61de41a7b-7ff61de41afc call 7ff61de41c80 * 2 call 7ff61de50744 734->741 740->721 753 7ff61de41b01-7ff61de41b14 call 7ff61de54fb4 741->753 756 7ff61de41b16-7ff61de41b30 call 7ff61de54f78 call 7ff61de42910 753->756 757 7ff61de41b35-7ff61de41b4e call 7ff61de5040c 753->757 756->721 763 7ff61de41b50-7ff61de41b6a call 7ff61de54f78 call 7ff61de42910 757->763 764 7ff61de41b6f-7ff61de41b8b call 7ff61de50180 757->764 763->721 770 7ff61de41b8d-7ff61de41b99 call 7ff61de42710 764->770 771 7ff61de41b9e-7ff61de41bac 764->771 770->721 771->721 774 7ff61de41bb2-7ff61de41bb9 771->774 777 7ff61de41bc1-7ff61de41bc7 774->777 778 7ff61de41bc9-7ff61de41bd6 777->778 779 7ff61de41be0-7ff61de41bef 777->779 780 7ff61de41bf1-7ff61de41bfa 778->780 779->779 779->780 781 7ff61de41bfc-7ff61de41bff 780->781 782 7ff61de41c0f 780->782 781->782 784 7ff61de41c01-7ff61de41c04 781->784 783 7ff61de41c11-7ff61de41c24 782->783 785 7ff61de41c26 783->785 786 7ff61de41c2d-7ff61de41c39 783->786 784->782 787 7ff61de41c06-7ff61de41c09 784->787 785->786 786->721 786->777 787->782 788 7ff61de41c0b-7ff61de41c0d 787->788 788->783
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FF61DE47F80: _fread_nolock.LIBCMT ref: 00007FF61DE4802A
                                                                                                                                        • _fread_nolock.LIBCMT ref: 00007FF61DE41A1B
                                                                                                                                          • Part of subcall function 00007FF61DE42910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF61DE41B6A), ref: 00007FF61DE4295E
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _fread_nolock$CurrentProcess
                                                                                                                                        • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                        • API String ID: 2397952137-3497178890
                                                                                                                                        • Opcode ID: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
                                                                                                                                        • Instruction ID: 19841400f2b1ba5b2bfbaa3f585fbb9b23ff546382527f49a21c4edb1c791c6c
                                                                                                                                        • Opcode Fuzzy Hash: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
                                                                                                                                        • Instruction Fuzzy Hash: F5818D75B08E8686EB64DB24D4402BB23A0EF48FA6F444535EA8DC7786FF3CE5858750
                                                                                                                                        Function 00007FF61DE41470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                        • Opcode ID: dd2fc87dbbd0b0694c4caf1c96eed29f086ec43e314d43e8a581fca28114ff0d
                                                                                                                                        • Instruction ID: 22c11e32826470f4654d2bbbd96a9e760ecdc82b35620d59b0794cf65665409f
                                                                                                                                        • Opcode Fuzzy Hash: dd2fc87dbbd0b0694c4caf1c96eed29f086ec43e314d43e8a581fca28114ff0d
                                                                                                                                        • Instruction Fuzzy Hash: 48414A26B08A9295EE10DB21A4405FB7390AF44FA5F444632EE5DC7B99FF3CE5028744
                                                                                                                                        Function 00007FFBBB42442C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84networkthreadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
                                                                                                                                        • String ID: 3'
                                                                                                                                        • API String ID: 4284410693-280543908
                                                                                                                                        • Opcode ID: 43883b4a1facdb44927345cb127c56be8221d0d2f4f6270d03b5dbc12515d140
                                                                                                                                        • Instruction ID: 27fec4832c9ca442d3e352b570ed60df555076a67336220003ac79328d98cf8d
                                                                                                                                        • Opcode Fuzzy Hash: 43883b4a1facdb44927345cb127c56be8221d0d2f4f6270d03b5dbc12515d140
                                                                                                                                        • Instruction Fuzzy Hash: 0D3170B1B28F5686EB608F39E4541797690FF44794F448A35EF4E827B4DF3CE440A608
                                                                                                                                        Function 00007FF61DE41210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 996 7ff61de41210-7ff61de4126d call 7ff61de4bdf0 999 7ff61de41297-7ff61de412af call 7ff61de54fb4 996->999 1000 7ff61de4126f-7ff61de41296 call 7ff61de42710 996->1000 1005 7ff61de412b1-7ff61de412cf call 7ff61de54f78 call 7ff61de42910 999->1005 1006 7ff61de412d4-7ff61de412e4 call 7ff61de54fb4 999->1006 1017 7ff61de41439-7ff61de4146d call 7ff61de4bad0 call 7ff61de54fa0 * 2 1005->1017 1011 7ff61de41309-7ff61de4131b 1006->1011 1012 7ff61de412e6-7ff61de41304 call 7ff61de54f78 call 7ff61de42910 1006->1012 1016 7ff61de41320-7ff61de41345 call 7ff61de5040c 1011->1016 1012->1017 1025 7ff61de4134b-7ff61de41355 call 7ff61de50180 1016->1025 1026 7ff61de41431 1016->1026 1025->1026 1031 7ff61de4135b-7ff61de41367 1025->1031 1026->1017 1034 7ff61de41370-7ff61de41398 call 7ff61de4a230 1031->1034 1037 7ff61de41416-7ff61de4142c call 7ff61de42710 1034->1037 1038 7ff61de4139a-7ff61de4139d 1034->1038 1037->1026 1039 7ff61de41411 1038->1039 1040 7ff61de4139f-7ff61de413a9 1038->1040 1039->1037 1042 7ff61de413ab-7ff61de413b9 call 7ff61de50b4c 1040->1042 1043 7ff61de413d4-7ff61de413d7 1040->1043 1048 7ff61de413be-7ff61de413c1 1042->1048 1045 7ff61de413d9-7ff61de413e7 call 7ff61de69ea0 1043->1045 1046 7ff61de413ea-7ff61de413ef 1043->1046 1045->1046 1046->1034 1047 7ff61de413f5-7ff61de413f8 1046->1047 1051 7ff61de4140c-7ff61de4140f 1047->1051 1052 7ff61de413fa-7ff61de413fd 1047->1052 1053 7ff61de413cf-7ff61de413d2 1048->1053 1054 7ff61de413c3-7ff61de413cd call 7ff61de50180 1048->1054 1051->1026 1052->1037 1055 7ff61de413ff-7ff61de41407 1052->1055 1053->1037 1054->1046 1054->1053 1055->1016
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                        • API String ID: 2050909247-2813020118
                                                                                                                                        • Opcode ID: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                        • Instruction ID: d17ae7faa3185791224acdd691dc0739e5fa72277ec32a61cd21bdeca68bdfcf
                                                                                                                                        • Opcode Fuzzy Hash: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                        • Instruction Fuzzy Hash: E451AF22B08E8285EA619B15A4503BB6791BF85FA6F844235EE4DC7BD9FF3CE505C700
                                                                                                                                        Function 00007FF61DE436B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,00007FF61DE43804), ref: 00007FF61DE436E1
                                                                                                                                        • GetLastError.KERNEL32(?,00007FF61DE43804), ref: 00007FF61DE436EB
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42C9E
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF61DE43706,?,00007FF61DE43804), ref: 00007FF61DE42D63
                                                                                                                                          • Part of subcall function 00007FF61DE42C50: MessageBoxW.USER32 ref: 00007FF61DE42D99
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                        • API String ID: 3187769757-2863816727
                                                                                                                                        • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                        • Instruction ID: bcbf32164b2a06d131627cac1db057dd8a3b2c544c38752d36abe038377f86ca
                                                                                                                                        • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                        • Instruction Fuzzy Hash: 71215161F18E8291FA619B20E8553BB2250BF98FB6F804136E69DC25D5FF2CE505C700
                                                                                                                                        Function 00007FFBBB426144 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Bytes_SizeString$Arg_DeallocErr_FromParseResizeTuple_
                                                                                                                                        • String ID: negative buffersize in recv$n|i:recv
                                                                                                                                        • API String ID: 1342606314-3647384195
                                                                                                                                        • Opcode ID: 305ed9ba5d92207555bc009bd3fb456f9aa8074bc0363cc4f8e3912babf7d0a1
                                                                                                                                        • Instruction ID: 72e37cc0c078c2d6cf21279c82e95e5f3fe7ccc0d9eb1ddd055c69a674b278ca
                                                                                                                                        • Opcode Fuzzy Hash: 305ed9ba5d92207555bc009bd3fb456f9aa8074bc0363cc4f8e3912babf7d0a1
                                                                                                                                        • Instruction Fuzzy Hash: 66114AE5A29E4681EE148F79E8001B9B760FF88B84F048436DB4D466B8DF7CF448E708
                                                                                                                                        Function 00007FF61DE5BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                        • Instruction ID: d597bbf374f13cff36bc6f92747013d24d684438343d5ef71763537e02def977
                                                                                                                                        • Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                        • Instruction Fuzzy Hash: 23C1E62AA0CF8681EB609B1594403BF7764FB81FE2F594131EA4E83791EF7CE8558B01
                                                                                                                                        Function 00007FFBBB425950 Relevance: 10.6, APIs: 7, Instructions: 103COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Long_Occurred$Arg_KeywordsUnpack
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 591546834-0
                                                                                                                                        • Opcode ID: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
                                                                                                                                        • Instruction ID: a606e26c9757a3a4ab89d09a6ffc63c40a920dcf2288046d71cb6284b26326dd
                                                                                                                                        • Opcode Fuzzy Hash: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
                                                                                                                                        • Instruction Fuzzy Hash: 3A4180A2E29E4246FE649B39E44537832A0BF44BA4F188636DF1E437F0DF3CE4449658
                                                                                                                                        Function 00007FF61DE46350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                        • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                        • API String ID: 2050909247-2434346643
                                                                                                                                        • Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                        • Instruction ID: 257bd3d8306cb598088b913045bf854abea20bfab49c50b446cfd75a1f915626
                                                                                                                                        • Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                        • Instruction Fuzzy Hash: 07415E31A18EC791EA11DB20E4542EB6361FF54BA6F804136EA5DC3696FF3CE615C740
                                                                                                                                        Function 00007FFBBB427630 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_AuditFreeMem_ParseSizeSys_Tuple_
                                                                                                                                        • String ID: et:gethostbyname$idna$socket.gethostbyname
                                                                                                                                        • API String ID: 3195760359-1353326193
                                                                                                                                        • Opcode ID: 595bcfef9258296ee61c2dacbe02101686e4e44310b816866b841d278444c812
                                                                                                                                        • Instruction ID: 934967d6b7cd67acdd08e2b1c0b50af2e403649a4ca662a6d2b8c0c246d8ed7f
                                                                                                                                        • Opcode Fuzzy Hash: 595bcfef9258296ee61c2dacbe02101686e4e44310b816866b841d278444c812
                                                                                                                                        • Instruction Fuzzy Hash: 6A1151A1B28E4681E7108B3DE9401AA77A0FF88BD4F409136EB4E47B75DE3CE545DB08
                                                                                                                                        Function 00007FFBBB424668 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 863680558-0
                                                                                                                                        • Opcode ID: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
                                                                                                                                        • Instruction ID: 14a1da38a70a97ad0b0d080e1745072c3f253783f113f54a8f460df3e3577ace
                                                                                                                                        • Opcode Fuzzy Hash: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
                                                                                                                                        • Instruction Fuzzy Hash: D5014FB1B29E5682E7109B7EE94406A73A0FF88B90B509430EB5E43B74CE3CD4959B14
                                                                                                                                        Function 00007FFBBB42678C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Buffer_ErrorLastRelease$Arg_CheckErr_FromLong_ParseSignalsSizeSsize_tTuple_
                                                                                                                                        • String ID: y*|i:send
                                                                                                                                        • API String ID: 3302300731-3140140677
                                                                                                                                        • Opcode ID: 1f24af34c3af4eff5d4d036c24b7df943ef6aa73fb2235a6e6f475ea3271103e
                                                                                                                                        • Instruction ID: df2e889b6ef2258bdb58a85877c294b11a048bda2a22f001658c95d5559ff29b
                                                                                                                                        • Opcode Fuzzy Hash: 1f24af34c3af4eff5d4d036c24b7df943ef6aa73fb2235a6e6f475ea3271103e
                                                                                                                                        • Instruction Fuzzy Hash: 6C112EB1A19F8582EB108F69E4443AA73A0FB88794F104136DB8D83764DF3DD448DB44
                                                                                                                                        Function 00007FFBBB403AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567868830.00007FFBBB401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFBBB400000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567833060.00007FFBBB400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567915558.00007FFBBB407000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567962744.00007FFBBB40C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568026449.00007FFBBB40E000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb400000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: D_do_all_providedDeallocFrozenModule_ObjectSet_
                                                                                                                                        • String ID: openssl_md_meth_names
                                                                                                                                        • API String ID: 4100423519-1600430994
                                                                                                                                        • Opcode ID: 377f0c0f1d187c6f6c3e59a4c7b27003ffe99c0898c3aca503393d1ddc3b5551
                                                                                                                                        • Instruction ID: 7aad49c7d12168570631f2bd44a343951af1d33a9cb9893974c00b28af2d5509
                                                                                                                                        • Opcode Fuzzy Hash: 377f0c0f1d187c6f6c3e59a4c7b27003ffe99c0898c3aca503393d1ddc3b5551
                                                                                                                                        • Instruction Fuzzy Hash: 0D0121B1A0C6128AEF244B38E8052B96760FB88769FC48135DB4E466B5DF7CE944C70C
                                                                                                                                        Function 00007FF61DE55698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1279662727-0
                                                                                                                                        • Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                        • Instruction ID: 7c36126d518876e4fc44c6320ff065324226d1c8dce2f755373fe9353012999d
                                                                                                                                        • Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                        • Instruction Fuzzy Hash: 14419426E28B8283E7509F20955037E7360FB94BB5F109335E65C83AD2EF6CB5E08750
                                                                                                                                        Function 00007FFBBB42454C Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3905867726-0
                                                                                                                                        • Opcode ID: 132c99158f9a3ea89ea502ecae564c9cdf5c0a75580648827cc09a477b3f3839
                                                                                                                                        • Instruction ID: cd504ef26b7fe9b68c60525201a122cbe6f2d4ce88353c83f4665150e0350960
                                                                                                                                        • Opcode Fuzzy Hash: 132c99158f9a3ea89ea502ecae564c9cdf5c0a75580648827cc09a477b3f3839
                                                                                                                                        • Instruction Fuzzy Hash: F03195A2B18F9186E7608F3DE8443A573A0FB88794F504635DB5D43BA4DF3DD4459708
                                                                                                                                        Function 00007FFBBB425358 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FFBBB423D80: PyErr_Format.PYTHON312 ref: 00007FFBBB424102
                                                                                                                                        • PySys_Audit.PYTHON312 ref: 00007FFBBB4253B0
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: PyEval_SaveThread.PYTHON312 ref: 00007FFBBB42444A
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: connect.WS2_32 ref: 00007FFBBB42445D
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: PyEval_RestoreThread.PYTHON312 ref: 00007FFBBB424468
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: WSAGetLastError.WS2_32 ref: 00007FFBBB424476
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: WSAGetLastError.WS2_32 ref: 00007FFBBB424482
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: PyErr_CheckSignals.PYTHON312 ref: 00007FFBBB42448F
                                                                                                                                          • Part of subcall function 00007FFBBB42442C: WSASetLastError.WS2_32 ref: 00007FFBBB4244CC
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
                                                                                                                                        • String ID: connect$socket.connect
                                                                                                                                        • API String ID: 2206401578-326844852
                                                                                                                                        • Opcode ID: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
                                                                                                                                        • Instruction ID: b4045ca41e1c76abf72f3ad01699aeee4d6fb4bd9cbd58b0567f80c7578adfc4
                                                                                                                                        • Opcode Fuzzy Hash: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
                                                                                                                                        • Instruction Fuzzy Hash: 9C116DA1B28E8681FB209B3AF8417AA7360FF48784F449032DF4D87A65DE7CE544D708
                                                                                                                                        Function 00007FF61DE4CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3251591375-0
                                                                                                                                        • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                        • Instruction ID: a94a491b7ddcc93adf3b1e1d4b555633885377ed002c8eb1360746c9cb9bf8bb
                                                                                                                                        • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                        • Instruction Fuzzy Hash: 50316C24E08E4345FE64AB2698613FB27D1AF42FAAF440435EA0EC72D3FF2DA455C201
                                                                                                                                        Function 00007FF61DE59AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                        • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                        • Instruction ID: 7c9f7c8f16c41b9f7f880143933d566baea3787a8914af92c5e93f5bb505e12f
                                                                                                                                        • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                        • Instruction Fuzzy Hash: 5ED06718B18F8652EA142B705C990BE12516F49FA2F141478D90B86393FD6DA4494310
                                                                                                                                        Function 00007FF61DE501AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                        • Instruction ID: 26e90685628bbd6f861d60cfbd1e45a6af94ca96a3a9c64557f44be6648974cf
                                                                                                                                        • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                        • Instruction Fuzzy Hash: 9151F629B09A6286E6799A26940067F6A91BF44FF6F144734FE6C877C6EF3CE4018601
                                                                                                                                        Function 00007FF61DE5C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                        • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                        • Instruction ID: 072aa5118e6e1e3c355235a3fe87ba8bb255c599725f23d930cdafd956d3ad34
                                                                                                                                        • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                        • Instruction Fuzzy Hash: E511E365718E8181DA108B25A85416E7761BB45FF5F584331EE7D8B7E9EF7CD0118700
                                                                                                                                        Function 00007FFBAB74F6F0 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$RestoreSave
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3353078043-0
                                                                                                                                        • Opcode ID: 72bc6393a5c18614d46cfab4168319c2c6127b7f97f94dbdd702facbe3c5fd85
                                                                                                                                        • Instruction ID: 278d6e791b9bcd17265dfd748dde4fd4ecb82b477d768b0d29b4a4008cd425fe
                                                                                                                                        • Opcode Fuzzy Hash: 72bc6393a5c18614d46cfab4168319c2c6127b7f97f94dbdd702facbe3c5fd85
                                                                                                                                        • Instruction Fuzzy Hash: 22E0BF65E1AE86D3E6066B76F9580386261FF49B85F058034DE2D02775DEBC9495C700
                                                                                                                                        Function 00007FF61DE5ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,00007FF61DE5AA45,?,?,00000000,00007FF61DE5AAFA), ref: 00007FF61DE5AC36
                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF61DE5AA45,?,?,00000000,00007FF61DE5AAFA), ref: 00007FF61DE5AC40
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                        • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                        • Instruction ID: 8fce841485ed1fa94fe28ee403fbac6f387d1fba0f6778a0dcb94d64b644e81c
                                                                                                                                        • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                        • Instruction Fuzzy Hash: AF218119B1CF8242EF949761A49427F1682AF84FF6F084239DA2EC73D2EE6CB4459300
                                                                                                                                        Function 00007FF61DE5BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                        • Instruction ID: 110a86c5fd2440f975070306fcfaadfe7175e3f3acbdfb67957527c2785927ee
                                                                                                                                        • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                        • Instruction Fuzzy Hash: 9E41E63AA08B0187EA349B15E55027B73A4EB55FE6F140231DA8EC76D1EF2DF402CB61
                                                                                                                                        Function 00007FF61DE47F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                        • Opcode ID: 3444aa7209edb3b7be450d659aa5a443e70ab9b7aff340a2814dff51627c4016
                                                                                                                                        • Instruction ID: 8d8ead750fb9deb5d8691eee68f6b92e6cae3f758c0a3228d8e202b7da616cb5
                                                                                                                                        • Opcode Fuzzy Hash: 3444aa7209edb3b7be450d659aa5a443e70ab9b7aff340a2814dff51627c4016
                                                                                                                                        • Instruction Fuzzy Hash: A921E221B18E9286FA10AB22A5443BB9791BF45FE5F8C5430EE4DCB786EF7DE041C600
                                                                                                                                        Function 00007FF61DE5B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                        • Instruction ID: 1cede45fefbc5cfea18f20ad80a37b72713615c2664f09c31935c608750fa188
                                                                                                                                        • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                        • Instruction Fuzzy Hash: EB318F29A18E4285FB516B59984137E3650AF40FF6F424135EA2D833D2EF7DE4418B21
                                                                                                                                        Function 00007FF61DE599D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3947729631-0
                                                                                                                                        • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                        • Instruction ID: 1c6ded75ea6a4ff000642bbff6b477690eb980e3a9a2a33542c12f1625e94d21
                                                                                                                                        • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                        • Instruction Fuzzy Hash: 17218E36A04F828AEB658F64C8442ED37A0EB05B69F480639D72D86AD6EF39D584C750
                                                                                                                                        Function 00007FF61DE56004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                        • Instruction ID: a084b477103b8c2c2ff6d9bda4586d8e00fc2d8fff7aa9767ce7ac96469fd9f9
                                                                                                                                        • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                        • Instruction Fuzzy Hash: 7F11512EA1CA4182EA60AF51A40027FA364BF45FE5F544031EB4CD7E96EF3DF5408721
                                                                                                                                        Function 00007FF61DE663C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                        • Instruction ID: 0da2996c3c1f77315860f3afbf9312e08567dbbd2573e3bd2f4a53fcca5d4b7c
                                                                                                                                        • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                        • Instruction Fuzzy Hash: ED212172618E8186D7619F18D48037E76A1FB84FA5F544239E79D876D9EF3DD400CB00
                                                                                                                                        Function 00007FF61DE5042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                        • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                        • Instruction ID: 88f89054b0f493d670a83281a530279acdd3d77d4791b813a9544120a32b70c4
                                                                                                                                        • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                        • Instruction Fuzzy Hash: E501C429A08F9141EA04DF52990106BAB91BF86FF1F084631EE5C97BD6EE3CE1014300
                                                                                                                                        Function 00007FFBAB739310 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • SystemFunction036.ADVAPI32 ref: 00007FFBAB739339
                                                                                                                                          • Part of subcall function 00007FFBAB7247B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBAB7396B0), ref: 00007FFBAB7247D0
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Function036Systemabort
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 840804957-0
                                                                                                                                        • Opcode ID: 2537415fc417a6b34b20e5eb01f9e9acdf07538f3d38be22f7023d8ab2ca85b2
                                                                                                                                        • Instruction ID: 7aeea2633948c60e42f33b0fe45f8da8efa0e8fc23c4fc477574824e57834650
                                                                                                                                        • Opcode Fuzzy Hash: 2537415fc417a6b34b20e5eb01f9e9acdf07538f3d38be22f7023d8ab2ca85b2
                                                                                                                                        • Instruction Fuzzy Hash: 95E08CD2F0A18241E926267AF2820BA62815F897E0F14C130FF7E0A7F7CDACD8814640
                                                                                                                                        Function 00007FF61DE49070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FF61DE49400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF61DE445E4,00000000,00007FF61DE41985), ref: 00007FF61DE49439
                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00007FF61DE46466,?,00007FF61DE4336E), ref: 00007FF61DE49092
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2592636585-0
                                                                                                                                        • Opcode ID: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
                                                                                                                                        • Instruction ID: c1a27fb61605fa1edc16f9c93034a650d8fd6b5a3bc1089622d9fcfd2fd5efb5
                                                                                                                                        • Opcode Fuzzy Hash: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
                                                                                                                                        • Instruction Fuzzy Hash: 52D0C215F28A8541EE94A76BBA4663A5351AFCDFD4F88D035EE1D83B4AEC3CC0414B00
                                                                                                                                        Function 00007FFBBB426840 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1568094706.00007FFBBB421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBBB420000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1568060366.00007FFBBB420000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568132202.00007FFBBB429000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568170546.00007FFBBB431000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1568228682.00007FFBBB433000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbbb420000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: send
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2809346765-0
                                                                                                                                        • Opcode ID: 741226070898184501b116e7c74174f7785fe4d6321199a9325eb966bcb4c140
                                                                                                                                        • Instruction ID: 2ca451be76a21124d8a03435b3401ee4458b2dab9d458fc8da8c561b8e05e69f
                                                                                                                                        • Opcode Fuzzy Hash: 741226070898184501b116e7c74174f7785fe4d6321199a9325eb966bcb4c140
                                                                                                                                        • Instruction Fuzzy Hash: 7BE01AF2A25A8582DB149B66E0442687360F719FA4F249721CA780B3E0DE38D5E1C740
                                                                                                                                        Function 00007FF61DE5D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapAlloc.KERNEL32(?,?,?,00007FF61DE50D00,?,?,?,00007FF61DE5236A,?,?,?,?,?,00007FF61DE53B59), ref: 00007FF61DE5D6AA
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556220526.00007FF61DE41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF61DE40000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556197399.00007FF61DE40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556279240.00007FF61DE6B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE7E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556304223.00007FF61DE81000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1556441915.00007FF61DE95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ff61de40000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocHeap
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                        • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                        • Instruction ID: a56d2a2d2a2803016ae1ac0a4206fed0b8e390fd2f39b1ad449f8521ad65bf77
                                                                                                                                        • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                        • Instruction Fuzzy Hash: F6F05808B09B4284FE646B6558012BB12904F94FF2F880230DE2EC53D2FEAEE4828221

                                                                                                                                        Non-executed Functions

                                                                                                                                        Function 00007FFBAB7AF860 Relevance: 51.1, APIs: 21, Strings: 8, Instructions: 332libraryloadersynchronizationCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressProc$CurrentProcess$Mutex$FreeHeapRelease$CloseCreateHandleLibraryLoadObjectSingleWaitlstrlenmemset
                                                                                                                                        • String ID: EnumerateLoadedModulesW64$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
                                                                                                                                        • API String ID: 216332076-310313858
                                                                                                                                        • Opcode ID: b038ae8bf24d293b35074355b7a8fd8c4e14a7b2bc82f9a156c41ad261452786
                                                                                                                                        • Instruction ID: 3db43cbca9b493e47a2ecff4146c9d28781cc419cce131c5706fb9d964c4c9b4
                                                                                                                                        • Opcode Fuzzy Hash: b038ae8bf24d293b35074355b7a8fd8c4e14a7b2bc82f9a156c41ad261452786
                                                                                                                                        • Instruction Fuzzy Hash: 9AE16BA1A1BA8285FB528F35E8643B823A0FF45B58F448539DD6E877B4DFBCE1458340
                                                                                                                                        Function 00007FFBAB794400 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 372memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$Bytes_SubtypeType_$SizeStringmemcpy
                                                                                                                                        • String ID: PyBoolobject of type '' does not define a '__bool__' conversion$attempted to fetch exception but none was set$bool$bool$nump
                                                                                                                                        • API String ID: 267654650-1385115426
                                                                                                                                        • Opcode ID: 5b19ff20e297807e6c8ed0692743460b9d2a0711a6f10bff11810016ef58f501
                                                                                                                                        • Instruction ID: d1c55aed262d91bd8f46e8d9cd50aaff66abe015a2203bfe5edafd8a3cf58ce0
                                                                                                                                        • Opcode Fuzzy Hash: 5b19ff20e297807e6c8ed0692743460b9d2a0711a6f10bff11810016ef58f501
                                                                                                                                        • Instruction Fuzzy Hash: B0024E72A1AB9185E762CF31D8503BD37A0FB44798F049135EE9E42BB5DFB8E5858380
                                                                                                                                        Function 00007FFBAB7AF840 Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 206libraryloadersynchronizationCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressProc$CurrentProcess$Mutex$FreeHeapRelease$CloseCreateHandleLibraryLoadObjectSingleWaitlstrlenmemset
                                                                                                                                        • String ID: EnumerateLoadedModulesW64$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$dbghelp.dll
                                                                                                                                        • API String ID: 216332076-258432709
                                                                                                                                        • Opcode ID: 166b2fc8eda8fb6c2b80d6f1c631b73bff6da84fe8678b1543cdfcaeefe9fd24
                                                                                                                                        • Instruction ID: c50806a7da38204aad58ea27303660b74e208eede846549828c7194b7c269798
                                                                                                                                        • Opcode Fuzzy Hash: 166b2fc8eda8fb6c2b80d6f1c631b73bff6da84fe8678b1543cdfcaeefe9fd24
                                                                                                                                        • Instruction Fuzzy Hash: D4913EA1A0BA4285FB529F36E86437523A0BF46B88F44C539DD2E873B4DFBCE5458340
                                                                                                                                        Function 00007FFBAB7A804E Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 247memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 00007FFBAB7A8341
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorLast$FreeHeap$EnvironmentVariable
                                                                                                                                        • String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
                                                                                                                                        • API String ID: 3745898529-1921098361
                                                                                                                                        • Opcode ID: f7db8e9fd48650a0dcc63bf239c59116b58963a9da7f789f35a0220ce165d66d
                                                                                                                                        • Instruction ID: d65ef544d64893bd81875d61e0252ae200efccf1e2ece612a4958777cd540d69
                                                                                                                                        • Opcode Fuzzy Hash: f7db8e9fd48650a0dcc63bf239c59116b58963a9da7f789f35a0220ce165d66d
                                                                                                                                        • Instruction Fuzzy Hash: 44B164A2A06BC584E7628F35DC543E927A4FB48B98F44813ADE2D577B4DFB8D2858340
                                                                                                                                        Function 00007FFBAB785360 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 469COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Size$Bytes_Dict_String$CryptFromFunction036NextRandomSystemTuple_memcpymemset
                                                                                                                                        • String ID: 2bInvalid rounds$Supported prefixes are b'2a' or b'2b'$$attempted to fetch exception but none was set$called `Result::unwrap()` on an `Err` value$roundsprefix
                                                                                                                                        • API String ID: 3128514010-2229655796
                                                                                                                                        • Opcode ID: 2a2236641f686725d971932571c6858de71e1a5180355ed3920a5a940e68cf68
                                                                                                                                        • Instruction ID: 71b6a9f7369018c2d0e2a1901a6be13595809ef951f5d622c40954e2a2f0548d
                                                                                                                                        • Opcode Fuzzy Hash: 2a2236641f686725d971932571c6858de71e1a5180355ed3920a5a940e68cf68
                                                                                                                                        • Instruction Fuzzy Hash: 0432507291ABC689E7738F71D8403E937A0FB58358F448135DE9D1AA75EFB8A285C700
                                                                                                                                        Function 00007FFBAB786C00 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 285memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • attempted to fetch exception but none was set, xrefs: 00007FFBAB786FCA
                                                                                                                                        • called `Result::unwrap()` on an `Err` value, xrefs: 00007FFBAB78707C
                                                                                                                                        • attempted to fetch exception but none was set, xrefs: 00007FFBAB786F41
                                                                                                                                        • password and salt must not be emptyWarning: bcrypt.kdf() called with only round(s). This few is not secure: the parameter is linear, like PBKDF2., xrefs: 00007FFBAB786C6F
                                                                                                                                        • rounds must be 1 or moredesired_key_bytes must be 1-512kdfdesired_key_bytesignore_few_rounds, xrefs: 00007FFBAB786E49
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: attempted to fetch exception but none was set$attempted to fetch exception but none was set$called `Result::unwrap()` on an `Err` value$password and salt must not be emptyWarning: bcrypt.kdf() called with only round(s). This few is not secure: the parameter is linear, like PBKDF2.$rounds must be 1 or moredesired_key_bytes must be 1-512kdfdesired_key_bytesignore_few_rounds
                                                                                                                                        • API String ID: 3298025750-4172883651
                                                                                                                                        • Opcode ID: 684e83356eac31b2c6d30aefd08a3b06e892e2d475b15fea7eb3ec7439644c80
                                                                                                                                        • Instruction ID: 8841c811b570639fffd55269591699b98e5a2ea57ac704081bc126c2e8d2834a
                                                                                                                                        • Opcode Fuzzy Hash: 684e83356eac31b2c6d30aefd08a3b06e892e2d475b15fea7eb3ec7439644c80
                                                                                                                                        • Instruction Fuzzy Hash: F4E15C72A05B8189E7228F71E8403E977A0FB48358F548535EEAD47BB5EFB8E584C300
                                                                                                                                        Function 00007FFBAB784790 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 301COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FromSizeStringUnicode_memcpymemset
                                                                                                                                        • String ID: @$anyD$cita$cyxO$etim$hsif$morh$tawS$wolB
                                                                                                                                        • API String ID: 1167034881-754498179
                                                                                                                                        • Opcode ID: 4edbef66dcfba9af4ed33b1c6a6a7cad411195298a6233e0232c7bb19994a639
                                                                                                                                        • Instruction ID: 5761f8933ecc860b2badb5d872d56a943f9ef0d557bbafe1c9fce0de54a3533f
                                                                                                                                        • Opcode Fuzzy Hash: 4edbef66dcfba9af4ed33b1c6a6a7cad411195298a6233e0232c7bb19994a639
                                                                                                                                        • Instruction Fuzzy Hash: BCC1F3A2A096C681E6238B35E4453F96760FB84784F048131EEAD177B5EFBDE5D2C740
                                                                                                                                        Function 00007FFBAB7AE9B0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 244filenativesynchronizationCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorHandle$CloseConsoleFileLastModeObjectSingleStatusWaitWrite
                                                                                                                                        • String ID: called `Result::unwrap()` on an `Err` value
                                                                                                                                        • API String ID: 3090192319-2333694755
                                                                                                                                        • Opcode ID: ad92ca9643529a214349323f216bfe942221eea34fd769e0edac2888f2b32232
                                                                                                                                        • Instruction ID: d324f6a3b50999b9a9f76188fd030c44710035bba9d9b3ceb4394dcb86839470
                                                                                                                                        • Opcode Fuzzy Hash: ad92ca9643529a214349323f216bfe942221eea34fd769e0edac2888f2b32232
                                                                                                                                        • Instruction Fuzzy Hash: E3B193A2A0969289FB528B30D8543FC27A1BB45398F94C539EE6E136F5DFBCD185C340
                                                                                                                                        Function 00007FFBAB74E460 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 313767242-0
                                                                                                                                        • Opcode ID: 44603e048716be1453d714337d9907225b0c190dc0f5b952bd87ebaf74cfa141
                                                                                                                                        • Instruction ID: 99736053c058859f9ff3dcf47f78e7808623212fe4cf8e942a53000b1bcd2311
                                                                                                                                        • Opcode Fuzzy Hash: 44603e048716be1453d714337d9907225b0c190dc0f5b952bd87ebaf74cfa141
                                                                                                                                        • Instruction Fuzzy Hash: 9B318EB2A0AAC186EB658F74E8503ED7361FB84354F44843ADE5E43BA8EF78C148C714
                                                                                                                                        Function 00007FFBB1893CE0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 313767242-0
                                                                                                                                        • Opcode ID: e020c4ec0d67dd7e6bfb2764331fe869e110cd68f761514c9e77e2adb1716b5d
                                                                                                                                        • Instruction ID: f1b83248018c54fff0755b61b54287de9c308b9ed4b4ba320f1a067cd479de78
                                                                                                                                        • Opcode Fuzzy Hash: e020c4ec0d67dd7e6bfb2764331fe869e110cd68f761514c9e77e2adb1716b5d
                                                                                                                                        • Instruction Fuzzy Hash: FF314CB2609B868AEB608F74EC503ED7360FB85788F54543ADB4E47A98DF38D648C704
                                                                                                                                        Function 00007FFBAB7B0BE8 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 313767242-0
                                                                                                                                        • Opcode ID: a8ed729cf85f9688053a69a5bd20c19050a670bab31094029aa6832676fcf7da
                                                                                                                                        • Instruction ID: ee1c37a9a281e07a927a7436b0856da4be224e09685eeca3251e7a2694011c9b
                                                                                                                                        • Opcode Fuzzy Hash: a8ed729cf85f9688053a69a5bd20c19050a670bab31094029aa6832676fcf7da
                                                                                                                                        • Instruction Fuzzy Hash: 4F315EB661AB818AEB618F70E8503ED7360FB84744F44843ADA5E47BA5EF78D548CB10
                                                                                                                                        Function 00007FFBAB7AE5D0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 219windowCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • NTDLL.DLL, xrefs: 00007FFBAB7AE625
                                                                                                                                        • assertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 00007FFBAB7AE90B
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorFormatHandleLastMessageModulememset
                                                                                                                                        • String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
                                                                                                                                        • API String ID: 1434010500-2380920079
                                                                                                                                        • Opcode ID: 684cc549f89e1fc54d7c6a704d798bcd8ffcbab249422ddb8e834ce379fa9a6a
                                                                                                                                        • Instruction ID: cf1446bf8421d9157fca2e3555df3909c57250f6295c81da3764a05191cce262
                                                                                                                                        • Opcode Fuzzy Hash: 684cc549f89e1fc54d7c6a704d798bcd8ffcbab249422ddb8e834ce379fa9a6a
                                                                                                                                        • Instruction Fuzzy Hash: 4AA196B2A0ABC284E7B78F30D8047F876A0BB45394F948139DD6D06BB4DFB89685D300
                                                                                                                                        Function 00007FFBAB6012F0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4139299733-0
                                                                                                                                        • Opcode ID: 35a4b164d7d926b41929bb2b2ac8d3737955662c15fe271b4beba82657301c78
                                                                                                                                        • Instruction ID: 60bda2640363f7e93f7d2c733cf2ca321bdb8df995e16d78d41eaa2338fe8544
                                                                                                                                        • Opcode Fuzzy Hash: 35a4b164d7d926b41929bb2b2ac8d3737955662c15fe271b4beba82657301c78
                                                                                                                                        • Instruction Fuzzy Hash: CAE112F2E1E552A1EF268B3AD81467DA3A5FB44781F14E131EE6E426B0DF2CE941D300
                                                                                                                                        Function 00007FFBAB7B3B20 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 179memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeapmemcpy
                                                                                                                                        • String ID: panic from Rust code
                                                                                                                                        • API String ID: 673829100-1247494419
                                                                                                                                        • Opcode ID: f787c6d101ea94c5fe7c73b5103b22650884813cbf9c3c4f4d7f1bc66369226a
                                                                                                                                        • Instruction ID: f4c23a047a6d575834a6d2b68273bb895a11c0713d83b54d9df82415896e9185
                                                                                                                                        • Opcode Fuzzy Hash: f787c6d101ea94c5fe7c73b5103b22650884813cbf9c3c4f4d7f1bc66369226a
                                                                                                                                        • Instruction Fuzzy Hash: DA71CEA1A1A74280FB169B72D8103B86761BF85B84F09C439CE6E1B7F5DEBCA5819710
                                                                                                                                        Function 00007FFBAB7AC870 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressSingleWake
                                                                                                                                        • String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
                                                                                                                                        • API String ID: 3114109732-896199136
                                                                                                                                        • Opcode ID: 9ceff5eb3485c97c19227f56a9344ca13e2ad755eb8e0911eea00aa880f34507
                                                                                                                                        • Instruction ID: 2f49a964850cbaffd945d39a2889c7d342c87fa695348ee1b442a5ceff9da7db
                                                                                                                                        • Opcode Fuzzy Hash: 9ceff5eb3485c97c19227f56a9344ca13e2ad755eb8e0911eea00aa880f34507
                                                                                                                                        • Instruction Fuzzy Hash: DFC16EA2A0AB9199EB92CB75D8503B937A0EB45B54F04803ADE6E573B4CFBDE4458340
                                                                                                                                        Function 00007FFBAB7A97B0 Relevance: 6.6, APIs: 5, Instructions: 399COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3510742995-0
                                                                                                                                        • Opcode ID: 8c5d0085528ac09bf5fcbc84ac76e41b089af8c4ee7d861544bc4e4290f8a703
                                                                                                                                        • Instruction ID: cfd60ade8ea095e265ccddc0c63e8db7f1c6d603f419f94158100b0e10829718
                                                                                                                                        • Opcode Fuzzy Hash: 8c5d0085528ac09bf5fcbc84ac76e41b089af8c4ee7d861544bc4e4290f8a703
                                                                                                                                        • Instruction Fuzzy Hash: A9E1E3A2F0AA9195EB46CB36D8443B92761BF44B98F50C539DE2E177B4DFBCA491C300
                                                                                                                                        Function 00007FFBB1892620 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
                                                                                                                                        • String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
                                                                                                                                        • API String ID: 2322464913-730042774
                                                                                                                                        • Opcode ID: 863090d98af343326a55469437a7a6c4584abefcef466bedd5b84cb14ecaba6f
                                                                                                                                        • Instruction ID: 8e350cc26e35761318ea7fa7407d893b722141a0b7bb8903f2bd184b88aaf451
                                                                                                                                        • Opcode Fuzzy Hash: 863090d98af343326a55469437a7a6c4584abefcef466bedd5b84cb14ecaba6f
                                                                                                                                        • Instruction Fuzzy Hash: 58A14BA1B1866352E724DF3EFE406B52292BF057DCF51A130CF0D8A665EE6DF508C618
                                                                                                                                        Function 00007FFBAB753030 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 364threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: MallocObject_memset$Err_Eval_OccurredThread$Arg_FromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_secretstream_xchacha20poly1305_pull
                                                                                                                                        • API String ID: 763106357-1737938762
                                                                                                                                        • Opcode ID: 328478146e856a6c39215ca313d56ded38f903befe153a7459b0e91b333a1171
                                                                                                                                        • Instruction ID: c96e2f44edf5b68b6fde060de8b0e1f1273b55ce77c9d829be6fdc309802ef18
                                                                                                                                        • Opcode Fuzzy Hash: 328478146e856a6c39215ca313d56ded38f903befe153a7459b0e91b333a1171
                                                                                                                                        • Instruction Fuzzy Hash: B3F14DA1A0AB8186EB569F32D8406A923A1FF44BE4F058235DD7E53BB4DFBCE5458300
                                                                                                                                        Function 00007FFBAB752AF0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 326threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: MallocObject_memset$Err_Occurred$Eval_Thread$Arg_FromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_secretstream_xchacha20poly1305_push
                                                                                                                                        • API String ID: 3558501603-2913017293
                                                                                                                                        • Opcode ID: 89393e078f1e672981bb27eb219ebfba800ae1fe155cbc288e4a532c0b4e8c17
                                                                                                                                        • Instruction ID: 30015d9d51bfa6485c23a0373833042fd892aefa3b1c6a7afecbc764b244e22a
                                                                                                                                        • Opcode Fuzzy Hash: 89393e078f1e672981bb27eb219ebfba800ae1fe155cbc288e4a532c0b4e8c17
                                                                                                                                        • Instruction Fuzzy Hash: EBE14DA1A0AB8585EB569F71E8406A823A0FF44BE4F048235ED7E53BB4DF7CE5858300
                                                                                                                                        Function 00007FFBAB750440 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 260threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_open
                                                                                                                                        • API String ID: 1141421562-1162375247
                                                                                                                                        • Opcode ID: 13a909811b206dbedd051132961c114e8e26da0cc4b9475d47155d46a57173bb
                                                                                                                                        • Instruction ID: 94067c2d0bf8546c4adfb659e19e6afc3c37a09ecd8c4d899711c920dba9759b
                                                                                                                                        • Opcode Fuzzy Hash: 13a909811b206dbedd051132961c114e8e26da0cc4b9475d47155d46a57173bb
                                                                                                                                        • Instruction Fuzzy Hash: 64B18DA1A0AB8286EB529F31D9406B923A0FF44BE4F04C635DD7D53BB4EEBCE5458340
                                                                                                                                        Function 00007FFBAB751B50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 260threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign
                                                                                                                                        • API String ID: 1141421562-1168224033
                                                                                                                                        • Opcode ID: a2d3a8d61029f6a484984733105569e42d26e16f70b189aa4b881582be8f4da4
                                                                                                                                        • Instruction ID: ff3bc93b8b3a2e159e7895e1d2f20748e753ab4caecfdea565e80b96c3313a0d
                                                                                                                                        • Opcode Fuzzy Hash: a2d3a8d61029f6a484984733105569e42d26e16f70b189aa4b881582be8f4da4
                                                                                                                                        • Instruction Fuzzy Hash: 7DB15BA1A0AB8285EA529F31D9406A823A0FB44BE5F058635ED7E17BB4DFBCE545D300
                                                                                                                                        Function 00007FFBB1887184 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
                                                                                                                                        • String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
                                                                                                                                        • API String ID: 553332449-1518367256
                                                                                                                                        • Opcode ID: 07cd809efcd9faf9132398e4ba4c3380ab0e61344d2b85e566d4ff3149f63d16
                                                                                                                                        • Instruction ID: a2855c5691d91c023aaadbe933981eafdfddf4876289b4fe93fb78129a6878e3
                                                                                                                                        • Opcode Fuzzy Hash: 07cd809efcd9faf9132398e4ba4c3380ab0e61344d2b85e566d4ff3149f63d16
                                                                                                                                        • Instruction Fuzzy Hash: 7D6178A2A18B4785EB648F7DEC0427963A1BF46BDCF585135DF0E466A8DF3CE4448309
                                                                                                                                        Function 00007FFBB1890AE4 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
                                                                                                                                        • String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
                                                                                                                                        • API String ID: 1879153319-1461672608
                                                                                                                                        • Opcode ID: 6f3379b1d24fde41776b7e4b56b53f78788d3cd6eba4d26311bad20b9349e0fb
                                                                                                                                        • Instruction ID: a626d5dc2e1b5b081ecafa7fe6ce1f819f6b6480daf6136dc813898a0aab8762
                                                                                                                                        • Opcode Fuzzy Hash: 6f3379b1d24fde41776b7e4b56b53f78788d3cd6eba4d26311bad20b9349e0fb
                                                                                                                                        • Instruction Fuzzy Hash: B551EBB5608B8685EB208F69FC402A973A8FB89BD8F645136CB8D43B64DF3CE454C744
                                                                                                                                        Function 00007FFBAB751206 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: MallocObject_$Arg_TupleUnpackmemset
                                                                                                                                        • String ID: crypto_sign_ed25519ph_final_create
                                                                                                                                        • API String ID: 4161193155-1937951566
                                                                                                                                        • Opcode ID: 22b1373519f1ea4b228e0ffbf1c6a71350c425e1e29ced09c1fc3012ac132942
                                                                                                                                        • Instruction ID: 98d2e325eada35e5f3d1cf3571bc6cdb57181afec1fefead24be2d9984a64ac5
                                                                                                                                        • Opcode Fuzzy Hash: 22b1373519f1ea4b228e0ffbf1c6a71350c425e1e29ced09c1fc3012ac132942
                                                                                                                                        • Instruction Fuzzy Hash: CAB17DA1A0AB8285EB529F71D9406A823A0FF44BE5F04C235DD7E57BB4DE7CE545C300
                                                                                                                                        Function 00007FFBAB751240 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 241threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_ed25519ph_final_create
                                                                                                                                        • API String ID: 3070247142-1937951566
                                                                                                                                        • Opcode ID: fed7c973d243802f06d94911d51068c5a26b5495ea18045a31e8bf8132e687c6
                                                                                                                                        • Instruction ID: 2baaf9bcde1034372f722571c2e4ed86ea44aa8e23ff240c3ea6841f3976293d
                                                                                                                                        • Opcode Fuzzy Hash: fed7c973d243802f06d94911d51068c5a26b5495ea18045a31e8bf8132e687c6
                                                                                                                                        • Instruction Fuzzy Hash: FFA18EA1A0AB8285EB569F71D8406A823A0FF44BE5F05C235DD3E57BB4EEBCE545D300
                                                                                                                                        Function 00007FFBAB752030 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 211threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_shorthash_siphashx24
                                                                                                                                        • API String ID: 1141421562-1336641056
                                                                                                                                        • Opcode ID: 0f916148c6b5972a76e46620cbe1ea170579029f39dec8724d7036d5156461a2
                                                                                                                                        • Instruction ID: b69ad069ffa83e95d6c8f0f96e129638c4d4784f64bdaa8cabdadcbf9ab4bb8d
                                                                                                                                        • Opcode Fuzzy Hash: 0f916148c6b5972a76e46620cbe1ea170579029f39dec8724d7036d5156461a2
                                                                                                                                        • Instruction Fuzzy Hash: 00917FA1A0AB8286EB169F31D8446A963A0FF44BE4F058235DE7D53BB4DF7CE945C300
                                                                                                                                        Function 00007FFBAB752450 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 211threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_shorthash_siphash24
                                                                                                                                        • API String ID: 1141421562-2565537803
                                                                                                                                        • Opcode ID: 9fb7d3965217b8441d839f81d58b088917d28a29426fdd696bf3853c1d8b2847
                                                                                                                                        • Instruction ID: d8521505ba7c7ba6d2c2ea0b1cae2bed506804a546d6d7f2d9293482afb597b7
                                                                                                                                        • Opcode Fuzzy Hash: 9fb7d3965217b8441d839f81d58b088917d28a29426fdd696bf3853c1d8b2847
                                                                                                                                        • Instruction Fuzzy Hash: FD917DA1A0AB8286EB529F31D9506A823A0FF04BE4F448635DE3D13BB4DF7CE945C300
                                                                                                                                        Function 00007FFBAB74EC20 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Object_Occurred$Eval_MallocThreadmemset$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: sodium_pad
                                                                                                                                        • API String ID: 62343735-4232714338
                                                                                                                                        • Opcode ID: 74ebc5e5e9de5e15ff477fd3974969f6cf7196c0757dbe8419509eca2eec163f
                                                                                                                                        • Instruction ID: 0b5ef627e6cc023a5e0480344240663082fa3eb49d388d446398450afbbdd041
                                                                                                                                        • Opcode Fuzzy Hash: 74ebc5e5e9de5e15ff477fd3974969f6cf7196c0757dbe8419509eca2eec163f
                                                                                                                                        • Instruction Fuzzy Hash: 46813E71A06B9286EB5A9F31D9402A933A0FF44BB5F448635DD3D03BF4DEBCE5458200
                                                                                                                                        Function 00007FFBB1887F84 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
                                                                                                                                        • String ID: argument 'data'$contiguous buffer$decompress
                                                                                                                                        • API String ID: 883004049-2667845042
                                                                                                                                        • Opcode ID: 78024c35833728618d9ef5976b2f5f6e763cecc9c3a38dd7dfd5804659b06d58
                                                                                                                                        • Instruction ID: 54eb35c51ee36b0d2e12ff51e88c6a3222dc3e3331fc1bb2e16de3413dd94f97
                                                                                                                                        • Opcode Fuzzy Hash: 78024c35833728618d9ef5976b2f5f6e763cecc9c3a38dd7dfd5804659b06d58
                                                                                                                                        • Instruction Fuzzy Hash: 0841ADA1A29B4682EB108F2AEC0027973A0FB4ABD8F645131DF4D537A4DF3CE445C708
                                                                                                                                        Function 00007FFBAB7292A0 Relevance: 21.4, APIs: 17, Instructions: 128COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: free$malloc
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2190258309-0
                                                                                                                                        • Opcode ID: b6d1e850fee2dd54d3160fed0130710df155c48f7f135d4c0be97370b5afda32
                                                                                                                                        • Instruction ID: faa687e5f3f249bcd6fc3b004a9d4f4fb3d93a5d488c4317ab925ac54a8d39a4
                                                                                                                                        • Opcode Fuzzy Hash: b6d1e850fee2dd54d3160fed0130710df155c48f7f135d4c0be97370b5afda32
                                                                                                                                        • Instruction Fuzzy Hash: AA51C172E0AA8189EB19DF31D4502BC73A4EB84758F049235EE6D57BFADF78E4418304
                                                                                                                                        Function 00007FFBAB750050 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 200threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Mallocmemset$Eval_Thread$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_seed_keypair
                                                                                                                                        • API String ID: 3070247142-3357599238
                                                                                                                                        • Opcode ID: a9b93a3f41f29e8f9afb043285dae6000894f07d683ed506fcb2a70f2cf52406
                                                                                                                                        • Instruction ID: fd509f5b342a5a4ba0c43ce413e7c8505e1804fbb41e5dd3710baa86872a6a1d
                                                                                                                                        • Opcode Fuzzy Hash: a9b93a3f41f29e8f9afb043285dae6000894f07d683ed506fcb2a70f2cf52406
                                                                                                                                        • Instruction Fuzzy Hash: 8E8149A1A0AB8686EB569F31D8406B923A0FB04BE4F058235DD7D53BB4DFBCE545C200
                                                                                                                                        Function 00007FFBAB793740 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 179COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ReleaseState_
                                                                                                                                        • String ID: PyErr$internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs$traceback<failed to extract type name>$type$value$} }((,]core\src\fmt\num.rs
                                                                                                                                        • API String ID: 3194932102-1798650309
                                                                                                                                        • Opcode ID: 52dc6c1fc541deebef018921d3a46cf38ff14278fc2acbb9eb8c9f353ea53f68
                                                                                                                                        • Instruction ID: 5bf9c5bd643406f7b6c78fa4a6f0c9fbdbb0c04617191d10396a0923fe06959a
                                                                                                                                        • Opcode Fuzzy Hash: 52dc6c1fc541deebef018921d3a46cf38ff14278fc2acbb9eb8c9f353ea53f68
                                                                                                                                        • Instruction Fuzzy Hash: AD819FA2A0AA5689EA52DB75D4407BC3760FB84BA4F05C035DE6E13BB1DFBCE585C700
                                                                                                                                        Function 00007FFBAB74E960 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 173threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Err_Eval_MallocOccurredThreadmemset$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: sodium_unpad
                                                                                                                                        • API String ID: 523341177-3102414059
                                                                                                                                        • Opcode ID: 95cbce0f33f4031ba85e3932f06cead46d0eb8d48702a51e779bc3452893a259
                                                                                                                                        • Instruction ID: 71798f6d145c1e0284f2a6961fcf2f77910ca2d6a1d74ba89e25a01e3b404827
                                                                                                                                        • Opcode Fuzzy Hash: 95cbce0f33f4031ba85e3932f06cead46d0eb8d48702a51e779bc3452893a259
                                                                                                                                        • Instruction Fuzzy Hash: 0B712EB1A0AB9285EA1A9F35D8406A833A0FF44BF5F448635DE7E17BB4DEBCD545C200
                                                                                                                                        Function 00007FFBB1890F6C Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
                                                                                                                                        • String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
                                                                                                                                        • API String ID: 1600877341-3984722346
                                                                                                                                        • Opcode ID: fbc5d7a925d27edacdea8a79866ca8ed75b1e95a1175fa0d907590f3df9feb70
                                                                                                                                        • Instruction ID: 9c91ceaa53457424ffba7500b82c7f0041994a32c811e3c9c4c25cce67d8fe66
                                                                                                                                        • Opcode Fuzzy Hash: fbc5d7a925d27edacdea8a79866ca8ed75b1e95a1175fa0d907590f3df9feb70
                                                                                                                                        • Instruction Fuzzy Hash: 476115B2A18A4689EB118F39EC400A937A4BB49BECF506532DB0D43B68DF39E545C748
                                                                                                                                        Function 00007FFBAB604808 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CompareUnicode_$DeallocStringWith
                                                                                                                                        • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                        • API String ID: 1004266020-3528878251
                                                                                                                                        • Opcode ID: af26892aff1d8045e963e496d2751d5e301b46a530bc7b3c9d9d9e4ca357d1c9
                                                                                                                                        • Instruction ID: f9df2f8149828df6e9dea4c62a3e1187afcd0bea5524a8dbff4f9937aa93ea6a
                                                                                                                                        • Opcode Fuzzy Hash: af26892aff1d8045e963e496d2751d5e301b46a530bc7b3c9d9d9e4ca357d1c9
                                                                                                                                        • Instruction Fuzzy Hash: 8C412DB1A0E642A5EE269B3BECA0335A3B1AB45B85F84E435DD6E47774DF2DE4048300
                                                                                                                                        Function 00007FFBAB6024D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
                                                                                                                                        • String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                        • API String ID: 2663085338-4141011787
                                                                                                                                        • Opcode ID: 13d2541d63d5590277e7306063f0ab8f10eec6f80969a73a59eba5495f8f2869
                                                                                                                                        • Instruction ID: 8612a5c22a4d0c9dd4b82be049fd916ffe0d82318543b363c6e6a06b1ff71210
                                                                                                                                        • Opcode Fuzzy Hash: 13d2541d63d5590277e7306063f0ab8f10eec6f80969a73a59eba5495f8f2869
                                                                                                                                        • Instruction Fuzzy Hash: 64313EB1A0A603A5FF175B3BDC64378A2A0AF49B81F44E131CD2D46AB5EF2CE5458310
                                                                                                                                        Function 00007FFBAB729660 Relevance: 19.7, APIs: 7, Strings: 6, Instructions: 165stringCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: strncmp
                                                                                                                                        • String ID: $argon2i$$argon2id$$m=$$v=$,p=$,t=
                                                                                                                                        • API String ID: 1114863663-2406504396
                                                                                                                                        • Opcode ID: c904bb6a6f1a51844abe8c65d59f0a38b64eda1e07d1abc08e88945078551c7d
                                                                                                                                        • Instruction ID: b975e3a4db82c898837777eb26cff7f9f55ba044694f01ad5587003b3e484905
                                                                                                                                        • Opcode Fuzzy Hash: c904bb6a6f1a51844abe8c65d59f0a38b64eda1e07d1abc08e88945078551c7d
                                                                                                                                        • Instruction Fuzzy Hash: 7371B2B1A0A68385EA628B35D4502A973A4FB847A4F48C235DEBD477B5EFBCE501C700
                                                                                                                                        Function 00007FFBAB7AB42A Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 283memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • stack backtrace:, xrefs: 00007FFBAB7AB9CD
                                                                                                                                        • note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 00007FFBAB7ABCF7
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
                                                                                                                                        • API String ID: 3298025750-3192684347
                                                                                                                                        • Opcode ID: 813da9d9665b9c410f1853eacdffa8c11019bd10bde6b9c150fb3fbd4096fca3
                                                                                                                                        • Instruction ID: a4ee37d13e401dffcdd6bdba3b9e5920d11d80138ce8a5d5788ba877ec4543e1
                                                                                                                                        • Opcode Fuzzy Hash: 813da9d9665b9c410f1853eacdffa8c11019bd10bde6b9c150fb3fbd4096fca3
                                                                                                                                        • Instruction Fuzzy Hash: 1CE16066506FC188EB728F35DC503EA37A0FB45799F44812ACE5D4BBA8DF799285C700
                                                                                                                                        Function 00007FFBAB797160 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 229COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: LongLong_$SubtypeType_
                                                                                                                                        • String ID: PyInt$a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs$attempted to fetch exception but none was set$out of range integral type conversion attemptedattempt to add with overflow
                                                                                                                                        • API String ID: 3116933419-4038138795
                                                                                                                                        • Opcode ID: 2f0a9dc1f97a8a450cd207e92100d698b0a4370e785d54f209fde2dc0d4ca4cb
                                                                                                                                        • Instruction ID: 564b1146977fc1edd6e53899bc16db4cd1f20e6a50d98b59bf5438219843acf6
                                                                                                                                        • Opcode Fuzzy Hash: 2f0a9dc1f97a8a450cd207e92100d698b0a4370e785d54f209fde2dc0d4ca4cb
                                                                                                                                        • Instruction Fuzzy Hash: 3EB14062919B8189E7529F35E8403FC77A0FF44358F148135EEAD06BB6EFB8E1958340
                                                                                                                                        Function 00007FFBAB7AFE50 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 220libraryloaderCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressProc$CurrentProcessmemset
                                                                                                                                        • String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace
                                                                                                                                        • API String ID: 3017635649-3384281969
                                                                                                                                        • Opcode ID: 801a1c74f7599b22cbe22b81268d2a3bc6735acb964657af0aa390194815a10f
                                                                                                                                        • Instruction ID: ed203a6c604f33e4c45f916c64f2518ba04220dd3cb36a5b274469e789cdb6be
                                                                                                                                        • Opcode Fuzzy Hash: 801a1c74f7599b22cbe22b81268d2a3bc6735acb964657af0aa390194815a10f
                                                                                                                                        • Instruction Fuzzy Hash: 6FB15E71A0AAC189EB328F25E8417E933A0FF45798F048135EE9D0B778DFB992958740
                                                                                                                                        Function 00007FFBAB74F460 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: sodium_memcmp
                                                                                                                                        • API String ID: 2840602441-1560747991
                                                                                                                                        • Opcode ID: 05cdcecad51f016033ac2513ce720465fba3c0b64cfe3eba95806447824f1ffa
                                                                                                                                        • Instruction ID: d2c3d60b36cafa465e33163e38e36bdf7425a70b57063eb45565ea44598b462c
                                                                                                                                        • Opcode Fuzzy Hash: 05cdcecad51f016033ac2513ce720465fba3c0b64cfe3eba95806447824f1ffa
                                                                                                                                        • Instruction Fuzzy Hash: D0614CB1A06B8296EB169F31D8401A873A0FF45BE5B458235DD3E47BB4EE7CE545C300
                                                                                                                                        Function 00007FFBAB750AC0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_Err_FreeFromLongLong_OccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_ed25519ph_update
                                                                                                                                        • API String ID: 2840602441-3055492586
                                                                                                                                        • Opcode ID: acbd5a5e1bac4a0378df5708bb6232c1535debc00269a9d8f8ed74897ace31b9
                                                                                                                                        • Instruction ID: ec82e1a5cd47096e10110f8118bfd5547e64932aa14c288f37e900d95195685e
                                                                                                                                        • Opcode Fuzzy Hash: acbd5a5e1bac4a0378df5708bb6232c1535debc00269a9d8f8ed74897ace31b9
                                                                                                                                        • Instruction Fuzzy Hash: EF6150A1A06B8296EB169F32E8505B923A0FF45BE4F048235DD7D47BB4EE7CE545C300
                                                                                                                                        Function 00007FFBAB6043F4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                        • String ID: $%04X$a unicode character$argument$decomposition
                                                                                                                                        • API String ID: 1318908108-4056541097
                                                                                                                                        • Opcode ID: 84a528a47654cdde31738837f18bb607aa473ddf7d16b6eb27ea2fde83817aeb
                                                                                                                                        • Instruction ID: 8fb182f6650a3b4b8bc0a33464f996dd220bcfc95f803dc8cfe27114a8af33d4
                                                                                                                                        • Opcode Fuzzy Hash: 84a528a47654cdde31738837f18bb607aa473ddf7d16b6eb27ea2fde83817aeb
                                                                                                                                        • Instruction Fuzzy Hash: B841C6E2A09682A1EE368B2AEC503B9A371FF55794F54D231CD7E476E4DF2CD5458300
                                                                                                                                        Function 00007FFBB1890994 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909B9
                                                                                                                                        • PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909D3
                                                                                                                                        • PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909E8
                                                                                                                                        • PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909FF
                                                                                                                                        • PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB1890A78
                                                                                                                                        • PyErr_Format.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB1890AC1
                                                                                                                                        • PyErr_SetString.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB1890ADA
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB1895A9C
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
                                                                                                                                        • String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
                                                                                                                                        • API String ID: 1881886752-3390802605
                                                                                                                                        • Opcode ID: c09fea354bee9dfd9f61b84e9b964c8cc1f2345fe841c0d04d13ce312f03767d
                                                                                                                                        • Instruction ID: ff725e8b33983633bb938e25822a9c1e4e22e8b70ee11e14195fcf92e96a651a
                                                                                                                                        • Opcode Fuzzy Hash: c09fea354bee9dfd9f61b84e9b964c8cc1f2345fe841c0d04d13ce312f03767d
                                                                                                                                        • Instruction Fuzzy Hash: CB41EAB1A08A0785EB648F6DFC9413863E4FF46BC8F58A132CB4E46761DE3CE4849348
                                                                                                                                        Function 00007FFBB1890548 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
                                                                                                                                        • String ID: _decode_filter_properties$argument 2$contiguous buffer
                                                                                                                                        • API String ID: 3656606796-2431706548
                                                                                                                                        • Opcode ID: a0c59856d18c07454747add572193a5a2b50d4e759bca78c702f92e163af3851
                                                                                                                                        • Instruction ID: 85d3e7706f71b98bf2280944a7d63a29875246234ef322290cf3e135c8d9bf05
                                                                                                                                        • Opcode Fuzzy Hash: a0c59856d18c07454747add572193a5a2b50d4e759bca78c702f92e163af3851
                                                                                                                                        • Instruction Fuzzy Hash: FB317FA1A08A4792EB108F3AEC441A96364FF99FC8FA46131DB4D53764DF3CE545C704
                                                                                                                                        Function 00007FFBB188844C Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$MemoryString
                                                                                                                                        • String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
                                                                                                                                        • API String ID: 60457842-2177155514
                                                                                                                                        • Opcode ID: cf423526ba8fe089124ee231bc1d987ac750035ebe6ec542011061509145b62e
                                                                                                                                        • Instruction ID: 6b2c0fdb55705619471c10f79b16234d6528aba58738665c9bf28c9c5f22f168
                                                                                                                                        • Opcode Fuzzy Hash: cf423526ba8fe089124ee231bc1d987ac750035ebe6ec542011061509145b62e
                                                                                                                                        • Instruction Fuzzy Hash: E121E5E2E3CA1395FB788B7CFD940781291BB4379CFB46039C70E455A49E6DF9458208
                                                                                                                                        Function 00007FFBAB791880 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 237COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: SubtypeType_
                                                                                                                                        • String ID: PyListutf-8$attempted to fetch exception but none was set$internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs
                                                                                                                                        • API String ID: 2891779845-4006478351
                                                                                                                                        • Opcode ID: d402a5bddec6cf993a4c99248ef3b54be23f2b9d41f555d6a3606dce80be98d6
                                                                                                                                        • Instruction ID: ef49c637dbc89157ecc4a1f7b81c820277859263c4492bdb63f46942bde7f802
                                                                                                                                        • Opcode Fuzzy Hash: d402a5bddec6cf993a4c99248ef3b54be23f2b9d41f555d6a3606dce80be98d6
                                                                                                                                        • Instruction Fuzzy Hash: 62B16DA2A0AA8189E7528F35D8403FC77A1FB48794F04C535EE9D42BB5EFB8E5948740
                                                                                                                                        Function 00007FFBAB791520 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 203COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttrObject_SlotType_
                                                                                                                                        • String ID: attempted to fetch exception but none was set$attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 2940939428-1262761291
                                                                                                                                        • Opcode ID: ffdf7ee8c29f7d676af22ac61808c750c3912d204388637560ab68b80d3761e9
                                                                                                                                        • Instruction ID: 808e54c3cc0f2212e445872e2b5760c8e8d4ede541884e429e0900246d4b1edb
                                                                                                                                        • Opcode Fuzzy Hash: ffdf7ee8c29f7d676af22ac61808c750c3912d204388637560ab68b80d3761e9
                                                                                                                                        • Instruction Fuzzy Hash: 03915B62A05B8289E7528F35D8403EC37A0FB88758F04C135EEAD52BA5DF78E595D340
                                                                                                                                        Function 00007FFBAB74FC00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_Err_FreeOccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: randombytes_buf_deterministic
                                                                                                                                        • API String ID: 2006385666-3771334770
                                                                                                                                        • Opcode ID: 33aebd85ffa1ea9a15ad9d51cedc152c3702a2cbc44ec5c96bc989e7e769f0ae
                                                                                                                                        • Instruction ID: 2a5182d9b95abd4358359e94965a63e72c3011e692d77c0c8ec9c2b961d3be4f
                                                                                                                                        • Opcode Fuzzy Hash: 33aebd85ffa1ea9a15ad9d51cedc152c3702a2cbc44ec5c96bc989e7e769f0ae
                                                                                                                                        • Instruction Fuzzy Hash: BB614CB2A06B9296EB169F31D8501A833A0FB48BA5F458235DE3D17BB4DF7CE546C300
                                                                                                                                        Function 00007FFBAB74F910 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_Err_FreeOccurredRestoreSaveTupleUnpack
                                                                                                                                        • String ID: sodium_add
                                                                                                                                        • API String ID: 2006385666-2631476576
                                                                                                                                        • Opcode ID: f864ad7c2a37ed7f2c7d4ef2263f7e6ffae786893542d1e0846adec0831214de
                                                                                                                                        • Instruction ID: 1b9e9bbf4cb0cd5c9ae60513e3eb1cd0889de3a5caf7c7f2b37e0858f74fa847
                                                                                                                                        • Opcode Fuzzy Hash: f864ad7c2a37ed7f2c7d4ef2263f7e6ffae786893542d1e0846adec0831214de
                                                                                                                                        • Instruction Fuzzy Hash: 48614CB1A0AB9296EB169F31D8501A933A0FB05BE5F058236DE3D47BB4DEBCE545C300
                                                                                                                                        Function 00007FFBAB750860 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_keypair
                                                                                                                                        • API String ID: 304895816-572272387
                                                                                                                                        • Opcode ID: 92e94d066fd0eea0119239aad3ea4c798aee1860caeed46abd15ee84d9ffc04f
                                                                                                                                        • Instruction ID: da60e109871c8ad70335be524fc92e9e986e18602a2e4f51a8e7a78bfcfafd73
                                                                                                                                        • Opcode Fuzzy Hash: 92e94d066fd0eea0119239aad3ea4c798aee1860caeed46abd15ee84d9ffc04f
                                                                                                                                        • Instruction Fuzzy Hash: 49514BA1A0AB8295EB169F32D8546B923A0FF44BE4B058236DD7D03BB8DF7CE545C300
                                                                                                                                        Function 00007FFBAB751890 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_ed25519_pk_to_curve25519
                                                                                                                                        • API String ID: 304895816-71057656
                                                                                                                                        • Opcode ID: b2ee9da6af9bfedef90fd01b65ef1eafd5f4cb0abb5596784adc7329a904e72c
                                                                                                                                        • Instruction ID: 36fb91f98daf9f758570d0747875772dd4ff9a3b71fcb0e4e01b359b85ff5007
                                                                                                                                        • Opcode Fuzzy Hash: b2ee9da6af9bfedef90fd01b65ef1eafd5f4cb0abb5596784adc7329a904e72c
                                                                                                                                        • Instruction Fuzzy Hash: 6A514BA1A0AB8296EB569F72D8506A823A0FF44BE5F058235DD7E07BB4DF7CE445C300
                                                                                                                                        Function 00007FFBAB751630 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Eval_MallocThreadmemset$Arg_FreeFromLongLong_RestoreSaveTupleUnpack
                                                                                                                                        • String ID: crypto_sign_ed25519_sk_to_curve25519
                                                                                                                                        • API String ID: 304895816-771027978
                                                                                                                                        • Opcode ID: 888e87db58276152ea39e7813fe6a287702764ce71321dff498e1bad8987d9af
                                                                                                                                        • Instruction ID: b805d22be497c653b35637ffe445a68bb29b0d4e4864e280112e440b04366aa6
                                                                                                                                        • Opcode Fuzzy Hash: 888e87db58276152ea39e7813fe6a287702764ce71321dff498e1bad8987d9af
                                                                                                                                        • Instruction Fuzzy Hash: 5B515EA1A06B8695EB569F36D8405A923A4FF08BE5F088635DD3E17BB4DEBCE445C300
                                                                                                                                        Function 00007FFBAB74D930 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 349153199-0
                                                                                                                                        • Opcode ID: 916b4cf56de2390981398b1966cbc275f0336d7d6125f07293e71cbb071e6920
                                                                                                                                        • Instruction ID: fc2fc9c45c57b3945f1f3c9482b9d7ec3380aa963599fed61e0bd4d8026c5f33
                                                                                                                                        • Opcode Fuzzy Hash: 916b4cf56de2390981398b1966cbc275f0336d7d6125f07293e71cbb071e6920
                                                                                                                                        • Instruction Fuzzy Hash: F1819CB1E0E2438AFA5A9B75D84127932A0AF45782F84C435DDAC833B6DEFCE9558600
                                                                                                                                        Function 00007FFBB18933B0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 349153199-0
                                                                                                                                        • Opcode ID: 5bcc3b39c83995861d1c1bee4646d5461f073c9fbca45882906c4372215123cf
                                                                                                                                        • Instruction ID: 921510ba753e5a081ae3cfb8ff1ba734c349eefb7147e38a085d476b2accbca0
                                                                                                                                        • Opcode Fuzzy Hash: 5bcc3b39c83995861d1c1bee4646d5461f073c9fbca45882906c4372215123cf
                                                                                                                                        • Instruction Fuzzy Hash: 328178A1E1864346FB61AF7EEC412796290BFC57CCF146134EF0D83796DE2DEA058608
                                                                                                                                        Function 00007FFBAB783C90 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 204COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy
                                                                                                                                        • String ID: Bnae$Dyrc$Sred$[called `Option::unwrap()` on a `None` valuecore\src\panicking.rs$]core\src\fmt\num.rs$assertion failed: !password.is_empty() && password.len() <= 72$hprO$lohe$tbuo
                                                                                                                                        • API String ID: 3510742995-1136739218
                                                                                                                                        • Opcode ID: 61b1c4146b4fc420e3e21e399872024411b39ba602cc74e943f98f8e40975719
                                                                                                                                        • Instruction ID: ee1652064cd4d90fb162332952544d61495f887d8ac36e2c2c7afdf2d813a949
                                                                                                                                        • Opcode Fuzzy Hash: 61b1c4146b4fc420e3e21e399872024411b39ba602cc74e943f98f8e40975719
                                                                                                                                        • Instruction Fuzzy Hash: 4671F5A2B1968542EA229B66E4403F96760FB99BC0F40C131EE5E17BB5DFBCD5C6C700
                                                                                                                                        Function 00007FFBB1887D7C Relevance: 16.7, APIs: 11, Instructions: 157COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Mem_$Eval_Threadmemcpy$Bytes_DeallocFreeFromMallocModuleReallocRestoreSaveSizeStateStringType_memmove
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2023644590-0
                                                                                                                                        • Opcode ID: 91bb494b46dd9212602284b5b2643fdfee3fcda04244e9e46cecea6de8c2d169
                                                                                                                                        • Instruction ID: ff84f01bb4d08d483f48534ce8d61fa7c38c368faebe8dcb52ff462784d75bb1
                                                                                                                                        • Opcode Fuzzy Hash: 91bb494b46dd9212602284b5b2643fdfee3fcda04244e9e46cecea6de8c2d169
                                                                                                                                        • Instruction Fuzzy Hash: B45138A2A29A4281EB618F7AED4423963A5FB15FD8F245031CF4D17758DF3CE4518308
                                                                                                                                        Function 00007FFBAB7AB4FA Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 373memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$memset
                                                                                                                                        • String ID: stack backtrace:
                                                                                                                                        • API String ID: 631287834-2306486365
                                                                                                                                        • Opcode ID: 9634775cb0ee68d8fde073cbafe456091d274fed3e66f10c23c1a04680deef64
                                                                                                                                        • Instruction ID: 05b2dd2d3f256de82a0ac519e3c63a5eaf6fc2ee4f6423c601e24b2509bfc118
                                                                                                                                        • Opcode Fuzzy Hash: 9634775cb0ee68d8fde073cbafe456091d274fed3e66f10c23c1a04680deef64
                                                                                                                                        • Instruction Fuzzy Hash: 53125B6660ABC48CE7B28F34DC403E937A0FB05759F44812ADE9D1BBA9DF789295C700
                                                                                                                                        Function 00007FFBAB794190 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 142COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB7941C7
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB7941D3
                                                                                                                                        • PyUnicode_AsUTF8String.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB7941DB
                                                                                                                                        • PyBytes_AsString.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB7941EB
                                                                                                                                        • PyBytes_Size.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB7941F6
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB794253
                                                                                                                                          • Part of subcall function 00007FFBAB792D60: Py_IncRef.PYTHON3 ref: 00007FFBAB792DAC
                                                                                                                                          • Part of subcall function 00007FFBAB792D60: Py_DecRef.PYTHON3 ref: 00007FFBAB792DEC
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFBAB794362
                                                                                                                                        Strings
                                                                                                                                        • attempted to fetch exception but none was set, xrefs: 00007FFBAB794303
                                                                                                                                        • PyStringPyBoolobject of type '' does not define a '__bool__' conversion, xrefs: 00007FFBAB794266
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Bytes_String$SizeSubtypeType_Unicode_
                                                                                                                                        • String ID: PyStringPyBoolobject of type '' does not define a '__bool__' conversion$attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 4287405956-1690906812
                                                                                                                                        • Opcode ID: 5bbc292fbcdf943ce9bbdcba00fc0fce834195961ac7fd3b4982d4f50e4922a4
                                                                                                                                        • Instruction ID: 36f3632721c6fbdaf7de0e5e911bac2d3414291a5da8348ea927342fd2c52b3a
                                                                                                                                        • Opcode Fuzzy Hash: 5bbc292fbcdf943ce9bbdcba00fc0fce834195961ac7fd3b4982d4f50e4922a4
                                                                                                                                        • Instruction Fuzzy Hash: 34519F72A05B9189F7628B71E8403BD73A0FB84354F04C234DEAD567B5EFB8E5858340
                                                                                                                                        Function 00007FFBAB791180 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 120memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • <unprintable object>PyStringPyListutf-8, xrefs: 00007FFBAB791270
                                                                                                                                        • PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs, xrefs: 00007FFBAB791306
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$FreeHeapRestoreUnraisableWrite
                                                                                                                                        • String ID: <unprintable object>PyStringPyListutf-8$PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs
                                                                                                                                        • API String ID: 483701198-2290150410
                                                                                                                                        • Opcode ID: 07095f1bae22b16a3c574a207e2bc2ffbe9699a3dda82b881e904258f87b7e59
                                                                                                                                        • Instruction ID: 0de6038f05c4957aa21dd0f8c5635a4e036b32d0f13d101d58d291d0dd907411
                                                                                                                                        • Opcode Fuzzy Hash: 07095f1bae22b16a3c574a207e2bc2ffbe9699a3dda82b881e904258f87b7e59
                                                                                                                                        • Instruction Fuzzy Hash: FE515AA2A06B4599EB62DBB1D8803EC37A0FB48798F048131DE5E53BB8DF78D594C340
                                                                                                                                        Function 00007FFBAB74EF20 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$Arg_Err_FreeFromLongLong_MallocOccurredRestoreSaveTupleUnpackmemset
                                                                                                                                        • String ID: sodium_munlock
                                                                                                                                        • API String ID: 1314505625-1861675732
                                                                                                                                        • Opcode ID: 5cd3da3e7c2f8dc70df219077a462a09614d96ca902e8765ddfcf813a3ee4fed
                                                                                                                                        • Instruction ID: 77c2486dc3d31ee283b729a7c853bdb474c07a6246e401797ed5e273fdbe369a
                                                                                                                                        • Opcode Fuzzy Hash: 5cd3da3e7c2f8dc70df219077a462a09614d96ca902e8765ddfcf813a3ee4fed
                                                                                                                                        • Instruction Fuzzy Hash: 82412CB1A06B8296EB5A9F31E8101A873A0FF44BE5F498635DE7D07BB4DE7CE5458300
                                                                                                                                        Function 00007FFBAB74F0E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$Arg_Err_FreeFromLongLong_MallocOccurredRestoreSaveTupleUnpackmemset
                                                                                                                                        • String ID: sodium_mlock
                                                                                                                                        • API String ID: 1314505625-4152466301
                                                                                                                                        • Opcode ID: e46fc1fb132002925f6194b704cd2176c5dbc7162ab1bfc6af3d9159585d4c2a
                                                                                                                                        • Instruction ID: e4e47607a050ef7b821c2267360666810914c9a7c42132df940c2dd8b0bba32a
                                                                                                                                        • Opcode Fuzzy Hash: e46fc1fb132002925f6194b704cd2176c5dbc7162ab1bfc6af3d9159585d4c2a
                                                                                                                                        • Instruction Fuzzy Hash: 1E413FB5A0AA8296EB569F71D8101A83390FF45FE5F058635DD3D0BBB4DE7CE5458300
                                                                                                                                        Function 00007FFBAB74E870 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dealloc$CallFromImportImport_Long_MethodModuleObject_Void
                                                                                                                                        • String ID: _cffi_backend$_init_cffi_1_0_external_module$_sodium
                                                                                                                                        • API String ID: 993162909-2117666076
                                                                                                                                        • Opcode ID: 3d4ad587a1467b3a4af87af1aba8882a648221bfda96ff515ce67ad11b4b3a6d
                                                                                                                                        • Instruction ID: 8384db29a472ab795ce469d6cfe77ca3c0d917f2637587be592fbdca251fe219
                                                                                                                                        • Opcode Fuzzy Hash: 3d4ad587a1467b3a4af87af1aba8882a648221bfda96ff515ce67ad11b4b3a6d
                                                                                                                                        • Instruction Fuzzy Hash: 1F215CB1A0AB8281EA0A9B35F85417973A4BF44B94F448035DDAD06B74EF7CE045C700
                                                                                                                                        Function 00007FFBAB7B044C Relevance: 15.2, APIs: 10, Instructions: 227COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 190073905-0
                                                                                                                                        • Opcode ID: 1c3acfe3ae0871a792168721600fa1ca02004820df210c59e4f58e325af1c704
                                                                                                                                        • Instruction ID: ec2e5fadd73fbb06d4e383e37605e00d77588dca5018570cefafc764ec39f599
                                                                                                                                        • Opcode Fuzzy Hash: 1c3acfe3ae0871a792168721600fa1ca02004820df210c59e4f58e325af1c704
                                                                                                                                        • Instruction Fuzzy Hash: A781C3E0E0E2438AFA569B75D4516796290AF86780F04C039DD6F437B6DEFCE9418F00
                                                                                                                                        Function 00007FFBAB7A7A70 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 154memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 00007FFBAB7A7C7B
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ErrorLast$FreeHeap$CurrentDirectory
                                                                                                                                        • String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
                                                                                                                                        • API String ID: 1736059809-1921098361
                                                                                                                                        • Opcode ID: c5882b2f603b49040c2805bcaa6a59be3835651137ac1831a5d78d10e50e0c99
                                                                                                                                        • Instruction ID: c5e84b7e51bcf3df676e9bcca86e35cc8e2c46ad2506a94b36776437933b0027
                                                                                                                                        • Opcode Fuzzy Hash: c5882b2f603b49040c2805bcaa6a59be3835651137ac1831a5d78d10e50e0c99
                                                                                                                                        • Instruction Fuzzy Hash: 7651C6A2A06BC185E7B28F35EC543E92368BB05BA8F448135DD6D577F5DFBCA2858300
                                                                                                                                        Function 00007FFBAB791CA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttrObject_SubtypeType_
                                                                                                                                        • String ID: PyStringPyListutf-8$attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 3540899126-3053824340
                                                                                                                                        • Opcode ID: d096b064f0a998a39622ad2f1ce227f8c827e06de1d4a07ac0c839fa9303f78c
                                                                                                                                        • Instruction ID: 76cece13276a4714c4a5a4a29e977b5a03d6c036e10cd7edcabce7bd8c05ac13
                                                                                                                                        • Opcode Fuzzy Hash: d096b064f0a998a39622ad2f1ce227f8c827e06de1d4a07ac0c839fa9303f78c
                                                                                                                                        • Instruction Fuzzy Hash: F7617D62A05B8189E752CB35D8403EC7770FB88798F049235EE9D52BB9DFB8E595C340
                                                                                                                                        Function 00007FFBAB74F750 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$Arg_Err_FreeMallocOccurredRestoreSaveTupleUnpackmemset
                                                                                                                                        • String ID: sodium_increment
                                                                                                                                        • API String ID: 543795274-3431184570
                                                                                                                                        • Opcode ID: fb7720e8dd6df6449b6769245b6d63300170fa602d9d76a606fdbebbc7360dbf
                                                                                                                                        • Instruction ID: b972efa34f28d63a5666102c3e2e952a6fab701d248ae8870ddf1b6e065bbd81
                                                                                                                                        • Opcode Fuzzy Hash: fb7720e8dd6df6449b6769245b6d63300170fa602d9d76a606fdbebbc7360dbf
                                                                                                                                        • Instruction Fuzzy Hash: 01413FB1A0AB8696EB169F31D8401A833A4FF44BA5F458235DD7D1BBB4DFBCE5458300
                                                                                                                                        Function 00007FFBAB74F2A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$Arg_Err_FreeMallocOccurredRestoreSaveTupleUnpackmemset
                                                                                                                                        • String ID: sodium_memzero
                                                                                                                                        • API String ID: 543795274-114423811
                                                                                                                                        • Opcode ID: 9b9eee12b099959960f6f8ee260a5b0335d15ba49d719df7acf7cff10660febf
                                                                                                                                        • Instruction ID: e0837f753fb92b09d1fb3a91930624ff52b0f4ac6e7c6b64d028fbe43d4374f2
                                                                                                                                        • Opcode Fuzzy Hash: 9b9eee12b099959960f6f8ee260a5b0335d15ba49d719df7acf7cff10660febf
                                                                                                                                        • Instruction Fuzzy Hash: 72413EB1A0AA8286EB5A9F35D8401A833A0FF44BE5F058635DD7D07BB4DFBCE5458300
                                                                                                                                        Function 00007FFBAB74FE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$Arg_Err_FreeMallocOccurredRestoreSaveTupleUnpackmemset
                                                                                                                                        • String ID: randombytes
                                                                                                                                        • API String ID: 543795274-2378388924
                                                                                                                                        • Opcode ID: 33135ea1e3c759197dbf7f02c5796d14fe96c65932fded84b8f8fcdc665b7aee
                                                                                                                                        • Instruction ID: e430f63b23c3f35295eeaa8256cc67f57f7f09b8f81300e5af9001021ec3ab43
                                                                                                                                        • Opcode Fuzzy Hash: 33135ea1e3c759197dbf7f02c5796d14fe96c65932fded84b8f8fcdc665b7aee
                                                                                                                                        • Instruction Fuzzy Hash: 44412BA1A0AA8686EB169F35D8502A833A0FF04BE4F048635DE7D07BB4DFBCE5458300
                                                                                                                                        Function 00007FFBB1888264 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
                                                                                                                                        • String ID: argument$compress$contiguous buffer
                                                                                                                                        • API String ID: 1731275941-2310704374
                                                                                                                                        • Opcode ID: 1710324e1890defdd21b17d9bacbb847ef0aa93d57f44c5940ca499c10bc7f60
                                                                                                                                        • Instruction ID: 8c875ee62c1db8830b630596246799443e17f9c2ad5cbd6c85ebfdff78ce5d63
                                                                                                                                        • Opcode Fuzzy Hash: 1710324e1890defdd21b17d9bacbb847ef0aa93d57f44c5940ca499c10bc7f60
                                                                                                                                        • Instruction Fuzzy Hash: 7F1186A2B28A4682EB20CF39FD441B96361FB89BC8F645131DB5D53664EF3CD545C704
                                                                                                                                        Function 00007FFBAB794D00 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 223COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressReleaseSingleState_Wake
                                                                                                                                        • String ID: Cannot normalize a PyErr while already normalizing it.$Exception type missing$Exception value missing$called `Result::unwrap()` on an `Err` value$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
                                                                                                                                        • API String ID: 4094980778-3970063368
                                                                                                                                        • Opcode ID: ea326bdd80c923761357804e61f79a314a3b61ccfcd502fe3b66ac459aee43ea
                                                                                                                                        • Instruction ID: 204ba9cfd07a7ee81a75fb8bf502bb1abd3abc9e52c9be9c777deed90c26f6d2
                                                                                                                                        • Opcode Fuzzy Hash: ea326bdd80c923761357804e61f79a314a3b61ccfcd502fe3b66ac459aee43ea
                                                                                                                                        • Instruction Fuzzy Hash: 76B178B2A0AB9699FB52CB74D8803AD33A0BB48B54F048135DE6E437B4DF78E555C740
                                                                                                                                        Function 00007FFBAB797820 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Long$Long_Unsigned$IndexNumber_SubtypeType_
                                                                                                                                        • String ID: PyInt$attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 3562653683-2762574808
                                                                                                                                        • Opcode ID: e5c3217b0407ff34f53f7bc0e80c42aabdebdda946191458f4e252a6f276669f
                                                                                                                                        • Instruction ID: 135da92331ebedf8d42a466f83fd96c999899a5ec8fc3b84ad5ce53623acdef8
                                                                                                                                        • Opcode Fuzzy Hash: e5c3217b0407ff34f53f7bc0e80c42aabdebdda946191458f4e252a6f276669f
                                                                                                                                        • Instruction Fuzzy Hash: DE715F62A09B8185E7628F35E8413EC77A0FB54368F14D235DFAD16AB6DFB8E5C18340
                                                                                                                                        Function 00007FFBAB7B1F10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • Failed to initialize new exception type.C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\panic.rs, xrefs: 00007FFBAB7B212C
                                                                                                                                        • attempted to fetch exception but none was set, xrefs: 00007FFBAB7B20CC
                                                                                                                                        • pyo3_runtime.PanicException, xrefs: 00007FFBAB7B1F94
                                                                                                                                        • The exception raised when Rust code called from Python panics.Like SystemExit, this exception is derived from BaseException so thatit will typically propagate all the way through the stack and cause thePython interpreter to exit., xrefs: 00007FFBAB7B1F33, 00007FFBAB7B1F9B
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: The exception raised when Rust code called from Python panics.Like SystemExit, this exception is derived from BaseException so thatit will typically propagate all the way through the stack and cause thePython interpreter to exit.$Failed to initialize new exception type.C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\panic.rs$attempted to fetch exception but none was set$pyo3_runtime.PanicException
                                                                                                                                        • API String ID: 0-2827222623
                                                                                                                                        • Opcode ID: 79ce9c35bc8b4f7df98624d6d4a1cae4422b300c65196ac3b4d3a2a1c2a86109
                                                                                                                                        • Instruction ID: 25bafce235b168b4cdb1572d04268b03ab4a61eb8ca23ea43c916f15fcd6af46
                                                                                                                                        • Opcode Fuzzy Hash: 79ce9c35bc8b4f7df98624d6d4a1cae4422b300c65196ac3b4d3a2a1c2a86109
                                                                                                                                        • Instruction Fuzzy Hash: 09614FA2A1AB4298FB12DB74D8403FC7B60EB88358F44C135DE5E52BB5EFB89585C740
                                                                                                                                        Function 00007FFBB18922C8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1892314
                                                                                                                                        • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1892358
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1892374
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB18923C3
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dealloc$Bytes_FromSizeStringmemcpy
                                                                                                                                        • String ID: Unable to allocate output buffer.
                                                                                                                                        • API String ID: 76732796-2565006440
                                                                                                                                        • Opcode ID: 7e6e52558a76918f1c04f02efed9b09b75fcc3e1f17376c2b34d6999e78edcd4
                                                                                                                                        • Instruction ID: f0b90e05d3f1de6e562b43a1f6d99bd5be4cbe0e2ee75b26f32c2431c7cbb57f
                                                                                                                                        • Opcode Fuzzy Hash: 7e6e52558a76918f1c04f02efed9b09b75fcc3e1f17376c2b34d6999e78edcd4
                                                                                                                                        • Instruction Fuzzy Hash: 2A41F8F6A19A0682EB159F2AD85426D33A1FB49FD8F186432CF1D47765CF38E491D308
                                                                                                                                        Function 00007FFBB1890674 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyDict_New.PYTHON312(?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB1890681
                                                                                                                                          • Part of subcall function 00007FFBB18907A8: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907C0
                                                                                                                                          • Part of subcall function 00007FFBB18907A8: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907D1
                                                                                                                                          • Part of subcall function 00007FFBB18907A8: PyDict_SetItem.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907EC
                                                                                                                                        • PyErr_Format.PYTHON312(?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18959B2
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18959CE
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
                                                                                                                                        • String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
                                                                                                                                        • API String ID: 1484310907-3368833446
                                                                                                                                        • Opcode ID: 91cb8f3666e1edacc4223baa65b424d27f0813c95206cae5a5361e9645f71d82
                                                                                                                                        • Instruction ID: 586acf16ffac988ec06a87e744a38fbe40bbadbe72d6bbbb8086bdf4b6b23afd
                                                                                                                                        • Opcode Fuzzy Hash: 91cb8f3666e1edacc4223baa65b424d27f0813c95206cae5a5361e9645f71d82
                                                                                                                                        • Instruction Fuzzy Hash: 4D41EAB1A08A07A1EB644F3DED8417C23A4BF47BE8F546532CB1D466A4DF3DA4649B08
                                                                                                                                        Function 00007FFBAB7992D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 77memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799328
                                                                                                                                        • PyType_GetFlags.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799332
                                                                                                                                        • PyType_GetFlags.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799342
                                                                                                                                        • PyErr_SetString.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799363
                                                                                                                                        • PyErr_Fetch.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB7993B4
                                                                                                                                        • PyErr_NormalizeException.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB7993C2
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$FlagsType_$ExceptionFetchFreeHeapNormalizeString
                                                                                                                                        • String ID: exceptions must derive from BaseException
                                                                                                                                        • API String ID: 1681722754-3237872526
                                                                                                                                        • Opcode ID: 23ce27e6015a76eb5f334077a9ae4e448d20922272c5a12fee1ded809f01c123
                                                                                                                                        • Instruction ID: 782c5e8bd617212738f35b87effc5df8887ec8e2593367e998c1ebdab692c1ff
                                                                                                                                        • Opcode Fuzzy Hash: 23ce27e6015a76eb5f334077a9ae4e448d20922272c5a12fee1ded809f01c123
                                                                                                                                        • Instruction Fuzzy Hash: EF314CB2A05B0284FB05DB72E8443BC2775AB88BE4F448135DE6E57BB9DFB8D0858300
                                                                                                                                        Function 00007FFBB18960F4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyErr_SetString.PYTHON312(?,?,?,00007FFBB1894ADB,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB189612C
                                                                                                                                        • PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFBB1894ADB,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB189618F
                                                                                                                                        • PyList_Append.PYTHON312(?,?,?,00007FFBB1894ADB,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB18961A3
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00007FFBB1894ADB,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB18961BF
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00007FFBB1894ADB,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB18961D8
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeallocString$AppendBytes_Err_FromList_Size
                                                                                                                                        • String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
                                                                                                                                        • API String ID: 1563898963-3455802345
                                                                                                                                        • Opcode ID: f324e82e8e24720ac4521df37a4d0ff3bd7354094206c15d70150ee4e5a04364
                                                                                                                                        • Instruction ID: 7c16fd998155b7a96b807571d0c0c3b0fb4bf96b34e719b4a097273ed3794d26
                                                                                                                                        • Opcode Fuzzy Hash: f324e82e8e24720ac4521df37a4d0ff3bd7354094206c15d70150ee4e5a04364
                                                                                                                                        • Instruction Fuzzy Hash: E2313AE1A08F4681EB148F39ED4422963A1FB45BECF646232DB6E437A5DF3DE0418304
                                                                                                                                        Function 00007FFBAB7222C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62stringCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: strncmp$_errno
                                                                                                                                        • String ID: $argon2i$$$argon2id$
                                                                                                                                        • API String ID: 3947864663-3707189756
                                                                                                                                        • Opcode ID: b7ae1b4bdf60b1b790839c41ab3dd92b1631ef7a8bff5cd04e0a998292b46a92
                                                                                                                                        • Instruction ID: 8c3cd238443d66b64e7343c4088f270f5a15d6d6868706cf5859907213931801
                                                                                                                                        • Opcode Fuzzy Hash: b7ae1b4bdf60b1b790839c41ab3dd92b1631ef7a8bff5cd04e0a998292b46a92
                                                                                                                                        • Instruction Fuzzy Hash: 5C11EBB1F1A68241EA155736DC4016A7150AF44BE0F84D230EE3D577F6EF6CD9424700
                                                                                                                                        Function 00007FFBB188937C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
                                                                                                                                        • String ID: Already at end of stream
                                                                                                                                        • API String ID: 2195683152-1334556646
                                                                                                                                        • Opcode ID: 9601e2289d51d21ec8779e664fa9b4f8dc4677cc4458a79452242d903093e9e9
                                                                                                                                        • Instruction ID: ba529a7552d48fd89ac4d43a904c0d4f56b40a66c147f6fdb9ffdf7efc5b3703
                                                                                                                                        • Opcode Fuzzy Hash: 9601e2289d51d21ec8779e664fa9b4f8dc4677cc4458a79452242d903093e9e9
                                                                                                                                        • Instruction Fuzzy Hash: 47112BA1A08E4685EB44DF6AEC441696764FB89FC8F186072DF4E43759CF3CE455C348
                                                                                                                                        Function 00007FFBB1888DA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyThread_acquire_lock.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1888DC6
                                                                                                                                        • PyThread_release_lock.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1888DF8
                                                                                                                                        • PyErr_SetString.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1888E28
                                                                                                                                          • Part of subcall function 00007FFBB18882F8: PyType_GetModuleState.PYTHON312 ref: 00007FFBB1888331
                                                                                                                                          • Part of subcall function 00007FFBB18882F8: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFBB1888345
                                                                                                                                          • Part of subcall function 00007FFBB18882F8: PyList_New.PYTHON312 ref: 00007FFBB188835C
                                                                                                                                          • Part of subcall function 00007FFBB18882F8: PyEval_SaveThread.PYTHON312 ref: 00007FFBB18883AD
                                                                                                                                          • Part of subcall function 00007FFBB18882F8: PyEval_RestoreThread.PYTHON312 ref: 00007FFBB18883C7
                                                                                                                                        • PyEval_SaveThread.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1894CB4
                                                                                                                                        • PyThread_acquire_lock.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1894CC9
                                                                                                                                        • PyEval_RestoreThread.PYTHON312(?,?,?,00007FFBB18882CA), ref: 00007FFBB1894CD2
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
                                                                                                                                        • String ID: Compressor has been flushed
                                                                                                                                        • API String ID: 3871537485-3904734015
                                                                                                                                        • Opcode ID: c3b7087ad833fce0d64beab52061d4dad11a12050d4af67ee9c007ee3213d889
                                                                                                                                        • Instruction ID: 10f32e346550f5830660ddb0dbb0e8f6ebf00148afbd413717bfed47333b8511
                                                                                                                                        • Opcode Fuzzy Hash: c3b7087ad833fce0d64beab52061d4dad11a12050d4af67ee9c007ee3213d889
                                                                                                                                        • Instruction Fuzzy Hash: BA1130A1A18A8682E754CF6AFC441696365FB89FC9F245032DF0D47B54CF3CD455C304
                                                                                                                                        Function 00007FFBB1892D7C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
                                                                                                                                        • String ID: Repeated call to flush()
                                                                                                                                        • API String ID: 3871537485-194442007
                                                                                                                                        • Opcode ID: 5763431d039a01f31027d97699849c10c6246a06438ef5a0eac5ea659cfecf27
                                                                                                                                        • Instruction ID: 2022cf5138909ae4248783e3ea5daf749e41049cbcfa789bad068f3ac5150eb2
                                                                                                                                        • Opcode Fuzzy Hash: 5763431d039a01f31027d97699849c10c6246a06438ef5a0eac5ea659cfecf27
                                                                                                                                        • Instruction Fuzzy Hash: 4B114FA1A08A8686E7548F7AFC446796365FB85BC8F146031DB0E47B54CF3CE055C708
                                                                                                                                        Function 00007FFBAB7885C0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • uncaught panic at ffi boundary__title__bcrypt__summary__Modern(-ish) password hashing for your software and your servers__uri__https://github.com/pyca/bcrypt/__version_ex__4.2.1The Python Cryptographic Authority developers__author____email__cryptography-dev@py, xrefs: 00007FFBAB7886A9
                                                                                                                                        • PyO3 modules compiled for CPython 3.8 or older may only be initialized once per interpreter process, xrefs: 00007FFBAB788751
                                                                                                                                        • PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs, xrefs: 00007FFBAB78883F
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_ReleaseRestoreState_
                                                                                                                                        • String ID: PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs$PyO3 modules compiled for CPython 3.8 or older may only be initialized once per interpreter process$uncaught panic at ffi boundary__title__bcrypt__summary__Modern(-ish) password hashing for your software and your servers__uri__https://github.com/pyca/bcrypt/__version_ex__4.2.1The Python Cryptographic Authority developers__author____email__cryptography-dev@py
                                                                                                                                        • API String ID: 1316669603-2996974358
                                                                                                                                        • Opcode ID: 095e7274759509bf08e8c2831bb309795dcf14085cd1e90f745875a31da45563
                                                                                                                                        • Instruction ID: 5905271cfe62604563452cae9a276aa2c421a7d9723f6b2f187d4dbbee968d9e
                                                                                                                                        • Opcode Fuzzy Hash: 095e7274759509bf08e8c2831bb309795dcf14085cd1e90f745875a31da45563
                                                                                                                                        • Instruction Fuzzy Hash: 7A818EA1A1AA8685EB52DBB4E8403B83760BB44794F50C136DE6E537F5DFBCE485C700
                                                                                                                                        Function 00007FFBAB7A8F70 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 178memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,stderrstd\src\io\mod.rs,?), ref: 00007FFBAB7A91D3
                                                                                                                                        • HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,stderrstd\src\io\mod.rs,?), ref: 00007FFBAB7A91E8
                                                                                                                                        • WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,stderrstd\src\io\mod.rs,?), ref: 00007FFBAB7A9218
                                                                                                                                        Strings
                                                                                                                                        • lock count overflow in reentrant mutexstd\src\sync\reentrant_lock.rs, xrefs: 00007FFBAB7A90CC
                                                                                                                                        • use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 00007FFBAB7A90B4
                                                                                                                                        • stderrstd\src\io\mod.rs, xrefs: 00007FFBAB7A90F1
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$AddressSingleWake
                                                                                                                                        • String ID: lock count overflow in reentrant mutexstd\src\sync\reentrant_lock.rs$stderrstd\src\io\mod.rs$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
                                                                                                                                        • API String ID: 2995119335-290749801
                                                                                                                                        • Opcode ID: c04c6d64d25ea928f1afd26c8e6046ceb351cf29ec8d24c5abeee7a5945a5891
                                                                                                                                        • Instruction ID: 36dc5d73c476de04c04f512b6a6606055dd6766e6fb6cd73c988412f5024781b
                                                                                                                                        • Opcode Fuzzy Hash: c04c6d64d25ea928f1afd26c8e6046ceb351cf29ec8d24c5abeee7a5945a5891
                                                                                                                                        • Instruction Fuzzy Hash: 1A819C72A0AA8688EB92CB74D8503B93370EB44B94F10C136CE6D537B4DFB8E455C700
                                                                                                                                        Function 00007FFBAB786920 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 173COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dict_Size$NextTuple_
                                                                                                                                        • String ID: hashed_password$passwordsalt
                                                                                                                                        • API String ID: 3098111706-89629369
                                                                                                                                        • Opcode ID: ea9df970358f639f8f4ec83b7dc2ed002db0ec1d8e0f01e32e10758d5f9ac925
                                                                                                                                        • Instruction ID: 6390321fd80484c57398ff964b5e6d77aaade6480278a7701dd596aec882c716
                                                                                                                                        • Opcode Fuzzy Hash: ea9df970358f639f8f4ec83b7dc2ed002db0ec1d8e0f01e32e10758d5f9ac925
                                                                                                                                        • Instruction Fuzzy Hash: 3C816962909AC599E7229F79D8413F867B0FB58358F04D221EF9D12A76EF78E2D5C300
                                                                                                                                        Function 00007FFBAB784E80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 144COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyErr_Restore.PYTHON3 ref: 00007FFBAB784F7A
                                                                                                                                          • Part of subcall function 00007FFBAB795BB0: WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,00007FFBAB7B38BA), ref: 00007FFBAB795C61
                                                                                                                                          • Part of subcall function 00007FFBAB795BB0: Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,00007FFBAB7B38BA), ref: 00007FFBAB795C74
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799328
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: PyType_GetFlags.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799332
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: PyType_GetFlags.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799342
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: PyErr_SetString.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB799363
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: PyErr_Fetch.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB7993B4
                                                                                                                                          • Part of subcall function 00007FFBAB7992D0: PyErr_NormalizeException.PYTHON3(?,?,?,?,?,?,00000002,?,?,?,?,00007FFBAB791225), ref: 00007FFBAB7993C2
                                                                                                                                        Strings
                                                                                                                                        • uncaught panic at ffi boundary, xrefs: 00007FFBAB784E9C
                                                                                                                                        • PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs, xrefs: 00007FFBAB784FA7, 00007FFBAB785084
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$FlagsType_$AddressExceptionFetchFreeHeapNormalizeRestoreSingleStringWake
                                                                                                                                        • String ID: PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs$uncaught panic at ffi boundary
                                                                                                                                        • API String ID: 2036650306-2359858267
                                                                                                                                        • Opcode ID: 6973498d443c72c4670f573af48aa3cc140b10f7acb32ae06fc8a772dddaf923
                                                                                                                                        • Instruction ID: c632939fbdadf130507edfc999a49683ead826f0f57bdbf72b356c39c8192fd6
                                                                                                                                        • Opcode Fuzzy Hash: 6973498d443c72c4670f573af48aa3cc140b10f7acb32ae06fc8a772dddaf923
                                                                                                                                        • Instruction Fuzzy Hash: 5A615DB6A0AA8188EB02CFB5D4507F83761FB44B98F048036DE6E537B5CFA8E485C740
                                                                                                                                        Function 00007FFBAB7989F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$AttrFromObject_SizeStringUnicode_
                                                                                                                                        • String ID: attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 3490290563-3578100625
                                                                                                                                        • Opcode ID: a6e2e4c2fa9ec7a0ba6baafd2ddfb33302feb0fe24c069b9e8a50973ec765989
                                                                                                                                        • Instruction ID: 0297b3449a687656917ce64e1e3af9122c4fdc34cf1f43a6cc7757b81bbbf225
                                                                                                                                        • Opcode Fuzzy Hash: a6e2e4c2fa9ec7a0ba6baafd2ddfb33302feb0fe24c069b9e8a50973ec765989
                                                                                                                                        • Instruction Fuzzy Hash: 0D516FB2A19B4185E7569B35E8403B9B7A0FB89790F04C235DEAD437B4DFBCE5858700
                                                                                                                                        Function 00007FFBB18882F8 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2831925710-0
                                                                                                                                        • Opcode ID: a2942b2b3cc3aaf76af335611bba86baf22be6f77c9cce35cb1e8cce43473846
                                                                                                                                        • Instruction ID: c9328f736179bf565ecad3ad69c2b2d5588e1cda8f39f9d84ad5e386cea9619c
                                                                                                                                        • Opcode Fuzzy Hash: a2942b2b3cc3aaf76af335611bba86baf22be6f77c9cce35cb1e8cce43473846
                                                                                                                                        • Instruction Fuzzy Hash: 0D5191A2A29B4286EB608F39ED4023963A4FF49BA8F641235DF5D43790DF3CE450C308
                                                                                                                                        Function 00007FFBAB791F30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyBytes_AsString.PYTHON3(?,?,?,?,?,?,?,?,?,?,00000002,0000002D,?,?,00000000,?), ref: 00007FFBAB791F65
                                                                                                                                        • PyBytes_Size.PYTHON3(?,?,?,?,?,?,?,?,?,?,00000002,0000002D,?,?,00000000,?), ref: 00007FFBAB791F70
                                                                                                                                        • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000002,0000002D,?,?,00000000,?), ref: 00007FFBAB791FE3
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,00000002,0000002D,?,?,00000000,?), ref: 00007FFBAB791FFE
                                                                                                                                          • Part of subcall function 00007FFBAB7AF020: GetProcessHeap.KERNEL32(?,?,?,00007FFBAB7B20B6), ref: 00007FFBAB7B4361
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002), ref: 00007FFBAB7920DC
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Bytes_$HeapProcessSizeStringmemcpy
                                                                                                                                        • String ID: attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 961595539-3578100625
                                                                                                                                        • Opcode ID: 55974094640d2fac5ae3f613ec0c54d3df484af552feca9c4a0864432bb3c9ec
                                                                                                                                        • Instruction ID: 9596fcefe1e94b6a45dae9630496b0cb20f3f57a452da448f84596c77fd1ade4
                                                                                                                                        • Opcode Fuzzy Hash: 55974094640d2fac5ae3f613ec0c54d3df484af552feca9c4a0864432bb3c9ec
                                                                                                                                        • Instruction Fuzzy Hash: 8941A162A0A74189F7529B76E8403FD77A0BF88394F04C534DEAD16BB5EFBCA5858300
                                                                                                                                        Function 00007FFBAB6016F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                        • String ID: a unicode character$argument$category
                                                                                                                                        • API String ID: 1318908108-2068800536
                                                                                                                                        • Opcode ID: 85221ed5b794fefa614671eb505fc7944d537497b256900e3b823b4235f4782d
                                                                                                                                        • Instruction ID: 7fa60c2c5c4f31ab0a7f739e09fd35fa8f703eb72f32d90da0c73da5297cd825
                                                                                                                                        • Opcode Fuzzy Hash: 85221ed5b794fefa614671eb505fc7944d537497b256900e3b823b4235f4782d
                                                                                                                                        • Instruction Fuzzy Hash: DF5188A2B1E65662EF568B2ED850278A3A1FB44784F44E035EE6E477A0DF3CE951D300
                                                                                                                                        Function 00007FFBAB7934B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyException_GetCause.PYTHON3(?,?,?,?,?,?,FFFFFFFE,00000000,?,?,00007FFBAB7B24AF), ref: 00007FFBAB7934F0
                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,?,?,?,?,?,FFFFFFFE,00000000,?,?,00007FFBAB7B24AF), ref: 00007FFBAB793517
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,?,?,?,?,FFFFFFFE,00000000,?,?,00007FFBAB7B24AF), ref: 00007FFBAB793527
                                                                                                                                        • PyException_GetTraceback.PYTHON3(?,?,?,?,?,?,FFFFFFFE,00000000,?,?,00007FFBAB7B24AF), ref: 00007FFBAB79352F
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,?,?,?,?,FFFFFFFE,00000000,?,?,00007FFBAB7B24AF), ref: 00007FFBAB793540
                                                                                                                                        Strings
                                                                                                                                        • internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs, xrefs: 00007FFBAB7935E5
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Exception_$CauseSubtypeTracebackType_
                                                                                                                                        • String ID: internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs
                                                                                                                                        • API String ID: 1237401254-3170016410
                                                                                                                                        • Opcode ID: 604a232c9121b37160d42727c7ad0cc76d733a54ba2de33d42e0f3bfe0101b36
                                                                                                                                        • Instruction ID: 85162c1544fbb84ed35304f120f560ba0129e098c5262384b0322e295ac075bc
                                                                                                                                        • Opcode Fuzzy Hash: 604a232c9121b37160d42727c7ad0cc76d733a54ba2de33d42e0f3bfe0101b36
                                                                                                                                        • Instruction Fuzzy Hash: 8141B3B2A0A64285EA969F31E8402BD73A0FF48794F48C535DE6E437B1DFBCE4918700
                                                                                                                                        Function 00007FFBAB601000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                        • String ID: a unicode character$argument$bidirectional
                                                                                                                                        • API String ID: 1318908108-2110215792
                                                                                                                                        • Opcode ID: 5ca945e71462204c3220177ec9e6a27065e7f9c311bd085c84fc819a6770995f
                                                                                                                                        • Instruction ID: 8c44efbedf244b6e4167cb4712d6fc0ede3b611921872caa32990a1fdbd4f63f
                                                                                                                                        • Opcode Fuzzy Hash: 5ca945e71462204c3220177ec9e6a27065e7f9c311bd085c84fc819a6770995f
                                                                                                                                        • Instruction Fuzzy Hash: C541CAE1B1A68261EF5A8B2ADC51379A361FB04790F44E035EE7F476B4DE2DD891D300
                                                                                                                                        Function 00007FFBB1891DA8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
                                                                                                                                        • String ID: Invalid filter specifier for delta filter$|OO&
                                                                                                                                        • API String ID: 3027669873-2010576982
                                                                                                                                        • Opcode ID: bd69a466ad9a1613d19b9fc93098cca85c1df3d2d5ef2a47df2fc6a2b74c43d8
                                                                                                                                        • Instruction ID: eb22ce0d8ac28d23ebffc406eb7dab5626414154c77007920547607cbf466879
                                                                                                                                        • Opcode Fuzzy Hash: bd69a466ad9a1613d19b9fc93098cca85c1df3d2d5ef2a47df2fc6a2b74c43d8
                                                                                                                                        • Instruction Fuzzy Hash: F61105B5A09A07D6EB418F79EC4416D33A4FB49BA8F605036C60D83360EF7DE84AC748
                                                                                                                                        Function 00007FFBB1891D1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
                                                                                                                                        • String ID: Invalid filter specifier for BCJ filter$|OO&
                                                                                                                                        • API String ID: 3027669873-3728029529
                                                                                                                                        • Opcode ID: eef4ed3f56c045254ffbfb5974b48ec96859be9e64a20010dd14ba142b0993b3
                                                                                                                                        • Instruction ID: 9f48699360ea1a97634b702017f239ecd58b7f0b66d475633a293a4c720114fc
                                                                                                                                        • Opcode Fuzzy Hash: eef4ed3f56c045254ffbfb5974b48ec96859be9e64a20010dd14ba142b0993b3
                                                                                                                                        • Instruction Fuzzy Hash: 0B01B0B5A09A07DAEB019F79E8442A923A4BB45BA8F601036D60D82760EF7CE549C758
                                                                                                                                        Function 00007FFBAB784210 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 222memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy$FreeHeap
                                                                                                                                        • String ID: H$I$assertion failed: size <= isize::MAX as usizeC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\zeroize-1.8.1\src\lib.rs
                                                                                                                                        • API String ID: 4250714341-3363712791
                                                                                                                                        • Opcode ID: a2141e457bb03330660835066cf047891e2e232fc670c0e9076f24e91814db6d
                                                                                                                                        • Instruction ID: 94e058343e716aacaf854f13ec0f3a685e172d36ea8e917e1d22ebf58e34209f
                                                                                                                                        • Opcode Fuzzy Hash: a2141e457bb03330660835066cf047891e2e232fc670c0e9076f24e91814db6d
                                                                                                                                        • Instruction Fuzzy Hash: 52A1D2A2A0A79188EB128F75D8143E96BA0FB55798F09C235DEAD077B5DFBCD085C340
                                                                                                                                        Function 00007FFBAB729930 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 168COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy$memset
                                                                                                                                        • String ID: $v=$d$v=
                                                                                                                                        • API String ID: 438689982-2970539882
                                                                                                                                        • Opcode ID: 798d924741b00a6221063e9663516e96f8c97fc0c1ca4585f20e05d82394eaf7
                                                                                                                                        • Instruction ID: de339e5837e3de41d78c87c926514be0aa73dde1b23bbe52c7b9f659218c4ae5
                                                                                                                                        • Opcode Fuzzy Hash: 798d924741b00a6221063e9663516e96f8c97fc0c1ca4585f20e05d82394eaf7
                                                                                                                                        • Instruction Fuzzy Hash: 5861C0B6A2E58246EB12CF34D6406A8B7A1FB85794F489132DE6D076B4EFBDE041C700
                                                                                                                                        Function 00007FFBAB737870 Relevance: 9.2, APIs: 6, Instructions: 152COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _errno
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                        • Opcode ID: 5b5ea965766408341f452cf33eda0320e80564c0dad235cf15787f028b42bae9
                                                                                                                                        • Instruction ID: ce7a729b6cb8eb540246402f103f4b74dc8eb24bc184d8a2dc07c41092ecac0e
                                                                                                                                        • Opcode Fuzzy Hash: 5b5ea965766408341f452cf33eda0320e80564c0dad235cf15787f028b42bae9
                                                                                                                                        • Instruction Fuzzy Hash: 545192B3B0AB8581E6219B25E40076AB294FB847A4F448735EEBC07BF6DFBCD5518700
                                                                                                                                        Function 00007FFBAB7347E0 Relevance: 9.2, APIs: 6, Instructions: 152COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _errno
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2918714741-0
                                                                                                                                        • Opcode ID: cd17969be9fd8a46209540486fb74e70668003b1b83aa021649af66504eec2bd
                                                                                                                                        • Instruction ID: 251b6f7f051198a0c66a397260fe249bac24f95060139f08de8c581d61739888
                                                                                                                                        • Opcode Fuzzy Hash: cd17969be9fd8a46209540486fb74e70668003b1b83aa021649af66504eec2bd
                                                                                                                                        • Instruction Fuzzy Hash: 085192B3B0AB9585E6259B25E4003AAB294FB847E4F448635EEBC077F5DFBCD4418704
                                                                                                                                        Function 00007FFBAB750DB0 Relevance: 9.1, APIs: 6, Instructions: 90threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$FreeFromLongLong_MallocRestoreSavememset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 143042008-0
                                                                                                                                        • Opcode ID: 6a49661730ece699e79d4f2ee795441c8b116372a70244a318cc429c5d1c1c08
                                                                                                                                        • Instruction ID: 080a76b22a49ab9162cd9aa0004d3a3e6dc05c7e41e94c4d8aea44d0350258e1
                                                                                                                                        • Opcode Fuzzy Hash: 6a49661730ece699e79d4f2ee795441c8b116372a70244a318cc429c5d1c1c08
                                                                                                                                        • Instruction Fuzzy Hash: 7B3160A1A0AB969AEB469F31D8401B82390FF44BE4F188635DE3D17BB4DF7CE5858200
                                                                                                                                        Function 00007FFBAB787810 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FromSizeStringUnicode_$FreeHeap
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 615094250-0
                                                                                                                                        • Opcode ID: a59f6a9ba1fc35e8e868a821b384ddda45e13ed749649635d9e1b8503445c120
                                                                                                                                        • Instruction ID: c6f1667e2fa4d22fbac2367e3f2ef4b397ef13662183c5892a62a965c80ab519
                                                                                                                                        • Opcode Fuzzy Hash: a59f6a9ba1fc35e8e868a821b384ddda45e13ed749649635d9e1b8503445c120
                                                                                                                                        • Instruction Fuzzy Hash: 132181A2A16A4194EA43DBB2EC054B86760BF88BE4F08C531DE6E177B5DE78D586C300
                                                                                                                                        Function 00007FFBB18907A8 Relevance: 9.1, APIs: 6, Instructions: 53COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907C0
                                                                                                                                        • PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907D1
                                                                                                                                        • PyDict_SetItem.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB18907EC
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB1895A20
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00007FFBB18906A5,?,?,?,00007FFBB1890652,?,?,?,?,?,00007FFBB18905DD), ref: 00007FFBB1895A39
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 252187852-0
                                                                                                                                        • Opcode ID: 27993fa0dda24ef79b556295a8b5c1df6dc6f3f1e0714079da50ac1df06707be
                                                                                                                                        • Instruction ID: f599e32057cc3ee3296cee787e75c235a36a09f3b46834cfd7e1b278953863ed
                                                                                                                                        • Opcode Fuzzy Hash: 27993fa0dda24ef79b556295a8b5c1df6dc6f3f1e0714079da50ac1df06707be
                                                                                                                                        • Instruction Fuzzy Hash: BB1130A1E1CA4781EB544F79ED1827C23A4BF0ABD9F186031CB0E56B95DF3CE4418348
                                                                                                                                        Function 00007FFBAB7B3680 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 200threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB7B2350), ref: 00007FFBAB7B3809
                                                                                                                                        • PyEval_SaveThread.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB7B2350), ref: 00007FFBAB7B3834
                                                                                                                                        • PyEval_RestoreThread.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB7B2350), ref: 00007FFBAB7B389C
                                                                                                                                        Strings
                                                                                                                                        • called `Result::unwrap()` on an `Err` valuePyBytes, xrefs: 00007FFBAB7B3927
                                                                                                                                        • use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 00007FFBAB7B3976
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$AddressRestoreSaveSingleWake
                                                                                                                                        • String ID: called `Result::unwrap()` on an `Err` valuePyBytes$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
                                                                                                                                        • API String ID: 1021059194-1130503736
                                                                                                                                        • Opcode ID: a1e526a9aee40018e4ad93d85be47b042fcc73d6c1a8b7ad9e200a8ed2accbd9
                                                                                                                                        • Instruction ID: 51ae09db5064f1151f7396bd5c22970d9b7ed3d372ed91be34b7ddeee7351628
                                                                                                                                        • Opcode Fuzzy Hash: a1e526a9aee40018e4ad93d85be47b042fcc73d6c1a8b7ad9e200a8ed2accbd9
                                                                                                                                        • Instruction Fuzzy Hash: 2CA16DA1A0AB8285EB52CB75D8803B937A0FB44758F548135CE6E537B5DFBCE589CB00
                                                                                                                                        Function 00007FFBAB7930D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 172memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                          • Part of subcall function 00007FFBAB7A92F0: HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9413
                                                                                                                                          • Part of subcall function 00007FFBAB7A92F0: HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9426
                                                                                                                                          • Part of subcall function 00007FFBAB7A92F0: WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9451
                                                                                                                                        • PyErr_Restore.PYTHON3 ref: 00007FFBAB79331B
                                                                                                                                        • PyErr_PrintEx.PYTHON3 ref: 00007FFBAB793322
                                                                                                                                        • HeapFree.KERNEL32 ref: 00007FFBAB7933B8
                                                                                                                                        Strings
                                                                                                                                        • PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs, xrefs: 00007FFBAB79319A
                                                                                                                                        • stderrstd\src\io\mod.rs, xrefs: 00007FFBAB793115
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$Err_$AddressPrintRestoreSingleWake
                                                                                                                                        • String ID: PyErr state should never be invalid outside of normalizationC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\err\err_state.rs$stderrstd\src\io\mod.rs
                                                                                                                                        • API String ID: 1766594203-768795130
                                                                                                                                        • Opcode ID: e3b8ac6dfd1edc23b095fa91afe6a3df0c2b454e5981638d414b43422945605e
                                                                                                                                        • Instruction ID: 7d0ac1981c4a5d5be3e0c4a38d722a209cd91169b0d1702e6d0730c0190f0fa9
                                                                                                                                        • Opcode Fuzzy Hash: e3b8ac6dfd1edc23b095fa91afe6a3df0c2b454e5981638d414b43422945605e
                                                                                                                                        • Instruction Fuzzy Hash: 6191E572A06B8199E7528F70D8803EC3BA4FB44358F458179EE9D47BA9EFB8D159C340
                                                                                                                                        Function 00007FFBAB7B22E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs
                                                                                                                                        • API String ID: 0-3170016410
                                                                                                                                        • Opcode ID: 28830d8b4849299f7d08e596030196498d964b0c72b1540c6b3c14e8eb811c0b
                                                                                                                                        • Instruction ID: c1c4b107150fd396ede363fc1f7d05bcb9ca1f44710c9a011a84ec95cf32208f
                                                                                                                                        • Opcode Fuzzy Hash: 28830d8b4849299f7d08e596030196498d964b0c72b1540c6b3c14e8eb811c0b
                                                                                                                                        • Instruction Fuzzy Hash: EF713872A0AB8589E752CF30E8403E83764FB44798F059235EE9E02BB5DF78E595C740
                                                                                                                                        Function 00007FFBB18908A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PySequence_Size.PYTHON312(00000000,?,00000000,00007FFBB1890850), ref: 00007FFBB18908CC
                                                                                                                                        • PySequence_GetItem.PYTHON312(?,00000000,00007FFBB1890850), ref: 00007FFBB18908FF
                                                                                                                                          • Part of subcall function 00007FFBB1890994: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909B9
                                                                                                                                          • Part of subcall function 00007FFBB1890994: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909D3
                                                                                                                                          • Part of subcall function 00007FFBB1890994: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909E8
                                                                                                                                          • Part of subcall function 00007FFBB1890994: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFBB189091B,?,00000000,00007FFBB1890850), ref: 00007FFBB18909FF
                                                                                                                                        • PyErr_Format.PYTHON312(?,00000000,00007FFBB1890850), ref: 00007FFBB1895A6B
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
                                                                                                                                        • String ID: Too many filters - liblzma supports a maximum of %d
                                                                                                                                        • API String ID: 1062705235-2617632755
                                                                                                                                        • Opcode ID: 5f4f0a6f00a1b5a696d06ecc95e771c9b6013e12a89222ed64e72491e41ff6b5
                                                                                                                                        • Instruction ID: ede07ac7dd2a6dbae29832508261d0053857cc78913403bd92953bb60909f9b7
                                                                                                                                        • Opcode Fuzzy Hash: 5f4f0a6f00a1b5a696d06ecc95e771c9b6013e12a89222ed64e72491e41ff6b5
                                                                                                                                        • Instruction Fuzzy Hash: ED316BA1A08A0685FB645F3AEC041396694BB46FF8F146331DF7D577D5DE3CE0818208
                                                                                                                                        Function 00007FFBAB799000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Bytes_$SizeStringSubtypeType_
                                                                                                                                        • String ID: PyBytes
                                                                                                                                        • API String ID: 649399624-619639063
                                                                                                                                        • Opcode ID: 43d9b76a1ee11084d54a0ae1cc2fae02f32a019533ec01d2e3d2386b771d31c2
                                                                                                                                        • Instruction ID: e69aa994a269cb242d449d65e0b9b3929c56dc16823d1bf898e831e1c8bc1362
                                                                                                                                        • Opcode Fuzzy Hash: 43d9b76a1ee11084d54a0ae1cc2fae02f32a019533ec01d2e3d2386b771d31c2
                                                                                                                                        • Instruction Fuzzy Hash: E2316E62A16B4185F7569B31E9413B97360BB88394F04C634DEAD02BB5DFB8E1918300
                                                                                                                                        Function 00007FFBAB792C80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,FFFFFFFE,00000000,00000000,?,00007FFBAB7936C2), ref: 00007FFBAB792CCC
                                                                                                                                        • Py_IncRef.PYTHON3(?,?,FFFFFFFE,00000000,00000000,?,00007FFBAB7936C2), ref: 00007FFBAB792CDD
                                                                                                                                        • PyException_SetTraceback.PYTHON3(?,?,FFFFFFFE,00000000,00000000,?,00007FFBAB7936C2), ref: 00007FFBAB792CE8
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,FFFFFFFE,00000000,00000000,?,00007FFBAB7936C2), ref: 00007FFBAB792CF0
                                                                                                                                        Strings
                                                                                                                                        • internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs, xrefs: 00007FFBAB792D0D
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Exception_Traceback
                                                                                                                                        • String ID: internal error: entered unreachable code/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ptr\mod.rs
                                                                                                                                        • API String ID: 124006720-3170016410
                                                                                                                                        • Opcode ID: 475aee49a82c5cc535379b8e5e1113bc5b089f79189f2500a6c687284adea30c
                                                                                                                                        • Instruction ID: 2ea4f9ed582f09fe901797cc63127e08b9b0a333f976bec5a906f8ec9b62ceef
                                                                                                                                        • Opcode Fuzzy Hash: 475aee49a82c5cc535379b8e5e1113bc5b089f79189f2500a6c687284adea30c
                                                                                                                                        • Instruction Fuzzy Hash: D421C262A0A64195EA46AF31D9402FC2360EB85BE4F08C130DE2E177F5CF78E996C700
                                                                                                                                        Function 00007FFBB1891F38 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_$FormatOccurred
                                                                                                                                        • String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
                                                                                                                                        • API String ID: 4038069558-4068623215
                                                                                                                                        • Opcode ID: bddd67975317d219699696fb54cbfc43319f17ffd66f8deab09509460bed08a5
                                                                                                                                        • Instruction ID: ec5dcc71201d71032eea54e2be1ae5a1012dc223ef763504247b5e12a62d3749
                                                                                                                                        • Opcode Fuzzy Hash: bddd67975317d219699696fb54cbfc43319f17ffd66f8deab09509460bed08a5
                                                                                                                                        • Instruction Fuzzy Hash: FD2121A1A1CA4A81EB209F39EC443792350BF9A7ECF506631EB5E476D6DF3CE5058704
                                                                                                                                        Function 00007FFBAB722220 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41stringCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: strncmp
                                                                                                                                        • String ID: $argon2i$$$argon2id$
                                                                                                                                        • API String ID: 1114863663-3707189756
                                                                                                                                        • Opcode ID: 8c6ab05df6683a8214d3eccd0b4b9dedde0f568f79bee122c761e41d8aaf1675
                                                                                                                                        • Instruction ID: b898cd07d8f12729d49bd2bf8ab8c985d225ffed71fc9f47eee1a8ebe8282997
                                                                                                                                        • Opcode Fuzzy Hash: 8c6ab05df6683a8214d3eccd0b4b9dedde0f568f79bee122c761e41d8aaf1675
                                                                                                                                        • Instruction Fuzzy Hash: 6F01D8A1F1AA8181FA558B27E84016A6614BF48FD0F44E031EE6D57BB9DE6CD9818700
                                                                                                                                        Function 00007FFBAB785EFD Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 237memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: Invalid salt
                                                                                                                                        • API String ID: 3298025750-25393001
                                                                                                                                        • Opcode ID: e7a9e886d209b3d1a4095336995746c26765a93e443c15bd5fe4ca78761f39bb
                                                                                                                                        • Instruction ID: 17a3dae2c60f2a666bcd03df1f5dc3499a423ee5a841c72cdb39f6b5e4e3c8ba
                                                                                                                                        • Opcode Fuzzy Hash: e7a9e886d209b3d1a4095336995746c26765a93e443c15bd5fe4ca78761f39bb
                                                                                                                                        • Instruction Fuzzy Hash: 67C14BA2909AC298E7738F75D8407F837A1EB55358F44C135DE9D06AB6EFB8E2C58340
                                                                                                                                        Function 00007FFBAB7A865F Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 165memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: code$kind$messageKindError$} }((,]core\src\fmt\num.rs
                                                                                                                                        • API String ID: 3298025750-1502653432
                                                                                                                                        • Opcode ID: 45931a6dbac2bb8d0fdf7d5357c75dd748d240b103ee0a76d2c64579326346d2
                                                                                                                                        • Instruction ID: fb44251d15d4f810e61acff22b1824748dd6f622e8384a29867492786fe71db6
                                                                                                                                        • Opcode Fuzzy Hash: 45931a6dbac2bb8d0fdf7d5357c75dd748d240b103ee0a76d2c64579326346d2
                                                                                                                                        • Instruction Fuzzy Hash: D171B3E1E0F50285FBA68674C5883BE2B65EB84744F14C03BCE6D07AF5DEACA5858706
                                                                                                                                        Function 00007FFBAB7AED90 Relevance: 7.6, APIs: 5, Instructions: 147COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1956605914-0
                                                                                                                                        • Opcode ID: ea4cc58ae86d6ed304747845231d819064c4aa293ae449354170bc89c7e233b1
                                                                                                                                        • Instruction ID: 97e720fb7124ae933322c2396e399639a2fd9d1cf0548cfadf2452eb06e46a8a
                                                                                                                                        • Opcode Fuzzy Hash: ea4cc58ae86d6ed304747845231d819064c4aa293ae449354170bc89c7e233b1
                                                                                                                                        • Instruction Fuzzy Hash: F151E3B2A1A69246F7A28B30D8043F96251FB04794FA0C139ED6D57AF8DFBCD6858340
                                                                                                                                        Function 00007FFBAB793A60 Relevance: 7.6, APIs: 5, Instructions: 120memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$FromSizeStringUnicode_$AttrObject_
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3595954801-0
                                                                                                                                        • Opcode ID: d27693c539f71a1f57d3640d70b302eead4cac4e0c2633bfd98878dcdcb64806
                                                                                                                                        • Instruction ID: d6301c7caa7b38a56c4a7316aff1cda27fdbd4f8de75e261a538dc62d0b153d6
                                                                                                                                        • Opcode Fuzzy Hash: d27693c539f71a1f57d3640d70b302eead4cac4e0c2633bfd98878dcdcb64806
                                                                                                                                        • Instruction Fuzzy Hash: 36515B72A0AB8598EB429F35D8453EC37A1FB48798F048135EE6D467B8DFB8E585C340
                                                                                                                                        Function 00007FFBAB747EC0 Relevance: 7.6, APIs: 6, Instructions: 87COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2221118986-0
                                                                                                                                        • Opcode ID: 9ab0ab06c8e12ec6ee05f52cd4c47136f600c2b81488da03d5f364900ced87d7
                                                                                                                                        • Instruction ID: 6d2588a7cab1330e8ad2a95befd87c4661412e7635d8f432447bcd074166643e
                                                                                                                                        • Opcode Fuzzy Hash: 9ab0ab06c8e12ec6ee05f52cd4c47136f600c2b81488da03d5f364900ced87d7
                                                                                                                                        • Instruction Fuzzy Hash: 7C41A0B6715A8199E726DF35D8802D833A0FB48799F448131EF6C47BA9DF38D652C740
                                                                                                                                        Function 00007FFBAB753660 Relevance: 7.6, APIs: 5, Instructions: 87threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$FreeMallocRestoreSavememset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 14299922-0
                                                                                                                                        • Opcode ID: ef62aa277eb479a7177a2c6e28972a0eece3088488bd78b249812057ad041cf1
                                                                                                                                        • Instruction ID: f13a74b125084971dba6c8860833b089937320cf2d173a19bafdbcdb9e3a33a3
                                                                                                                                        • Opcode Fuzzy Hash: ef62aa277eb479a7177a2c6e28972a0eece3088488bd78b249812057ad041cf1
                                                                                                                                        • Instruction Fuzzy Hash: 2A3142A1A0AB8696EB569F31D8501B863A4FF04BE4F498635DD7E07BB4DF7CE4458200
                                                                                                                                        Function 00007FFBAB752990 Relevance: 7.6, APIs: 5, Instructions: 87threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Object_Thread$FreeMallocRestoreSavememset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 14299922-0
                                                                                                                                        • Opcode ID: 934df8348706b5c01a7b72582f06181d2460fa7fcb6751b161f56d607422a2bd
                                                                                                                                        • Instruction ID: 8acbf43922b06df95c0ad46a584658d1c24e5c62077cabf51636eaf0ef0179fe
                                                                                                                                        • Opcode Fuzzy Hash: 934df8348706b5c01a7b72582f06181d2460fa7fcb6751b161f56d607422a2bd
                                                                                                                                        • Instruction Fuzzy Hash: 2C314FA1A0ABC696EB569F31D85017823A0FF44BE4F098635DE7D07BB4DF7CE5458200
                                                                                                                                        Function 00007FFBAB749300 Relevance: 7.6, APIs: 6, Instructions: 86COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2221118986-0
                                                                                                                                        • Opcode ID: bd3ec456d7ebd6de702bd26a404b4663228491b369228fca87566203d0706ab9
                                                                                                                                        • Instruction ID: 6996e71aea743e14788247b3b2c4641dafb68c491b2c7fc634986c3c5762c721
                                                                                                                                        • Opcode Fuzzy Hash: bd3ec456d7ebd6de702bd26a404b4663228491b369228fca87566203d0706ab9
                                                                                                                                        • Instruction Fuzzy Hash: 08418DB270DA8495E735DB25E4802DAB3A0F788794F848136EF9D43BAADF7CD1118B00
                                                                                                                                        Function 00007FFBAB796D20 Relevance: 7.6, APIs: 5, Instructions: 67memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$FromSizeStringTuple_Unicode_$Item
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2495088647-0
                                                                                                                                        • Opcode ID: fb3358174f01b51b2f8cab808191c6c1ffcd569a2863b0fcf808a44337cc68ef
                                                                                                                                        • Instruction ID: c85435d90aa9bff051d131b9ec5f20f661a52fbb96b5ad4fd9da0b4b399d4236
                                                                                                                                        • Opcode Fuzzy Hash: fb3358174f01b51b2f8cab808191c6c1ffcd569a2863b0fcf808a44337cc68ef
                                                                                                                                        • Instruction Fuzzy Hash: 602180A2A16A4595FB569B36E8145BC27A4BF89B94F48C234DE3D037F4DF78E582C300
                                                                                                                                        Function 00007FFBAB7AA6A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 63memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: RUST_BACKTRACE$full
                                                                                                                                        • API String ID: 3298025750-4226689609
                                                                                                                                        • Opcode ID: c5599287746ec511d8196a3d5dd8e0cb615c5e35d978512fb6b407bfcd2aa2db
                                                                                                                                        • Instruction ID: 12ef02306bc37ae1429e58a1352c6b7831ecbd8b6fe9eea826663c2907bd0d97
                                                                                                                                        • Opcode Fuzzy Hash: c5599287746ec511d8196a3d5dd8e0cb615c5e35d978512fb6b407bfcd2aa2db
                                                                                                                                        • Instruction Fuzzy Hash: B8218EA5E0B68645FF97CB31C8642B623A2AF85744F44C43ACD2F0A3B4DEADB4419700
                                                                                                                                        Function 00007FFBAB787710 Relevance: 7.6, APIs: 5, Instructions: 63COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FromSizeStringUnicode_
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 674541731-0
                                                                                                                                        • Opcode ID: 8f87cc7247f7eb35cae673e3ebdaab5b73b88447858f4ab5146531e845202eb8
                                                                                                                                        • Instruction ID: 9288861cfb5c16ad7021dc37b7f8770392ef19c894ef6aaf9574f02d78f2acd6
                                                                                                                                        • Opcode Fuzzy Hash: 8f87cc7247f7eb35cae673e3ebdaab5b73b88447858f4ab5146531e845202eb8
                                                                                                                                        • Instruction Fuzzy Hash: 4811B192B1768158EA42AB72DD055FC2720AF84BE4F08C630EE6D437F6DE78D655C300
                                                                                                                                        Function 00007FFBB1892FAC Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Dealloc$Module_State
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3434497292-0
                                                                                                                                        • Opcode ID: 0932cb1aac9ba224d6c78b2b00829ff8f99f4bbbbef57d4d2090c7aa13e90f9a
                                                                                                                                        • Instruction ID: 9f833b9faee70459627440c76aa04e3eb51c2d88a95c5b5095e53f56aed2ecd4
                                                                                                                                        • Opcode Fuzzy Hash: 0932cb1aac9ba224d6c78b2b00829ff8f99f4bbbbef57d4d2090c7aa13e90f9a
                                                                                                                                        • Instruction Fuzzy Hash: 5621E7B2A0EA06C5FB694F78DC5433832A0BF45F8DF286531CB0E85591CF3DA5859318
                                                                                                                                        Function 00007FFBAB790A10 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 278COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 0-3578100625
                                                                                                                                        • Opcode ID: d60bdfbf957881fa372bbba2e6e38f0b8b4575cbbda90e8e3fc2f044b3b10a59
                                                                                                                                        • Instruction ID: e7a3e27d9b47104e08cd8643898c952a32c0971612623a077514f8c37b64a105
                                                                                                                                        • Opcode Fuzzy Hash: d60bdfbf957881fa372bbba2e6e38f0b8b4575cbbda90e8e3fc2f044b3b10a59
                                                                                                                                        • Instruction Fuzzy Hash: 80A1A272A29B8585E7429B34E4402B97760FB84754F548235EF9D43BB8EF7CE585CB00
                                                                                                                                        Function 00007FFBAB7903F9 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
                                                                                                                                        • API String ID: 0-459553403
                                                                                                                                        • Opcode ID: ea96c810c6dafe6e8adf8b6475cf65ae810485d81d67b467018af45c71e03bc6
                                                                                                                                        • Instruction ID: 5b90b985f0f0af837fb926f73f84bae47116da8986d91a05aec4a584a67f5231
                                                                                                                                        • Opcode Fuzzy Hash: ea96c810c6dafe6e8adf8b6475cf65ae810485d81d67b467018af45c71e03bc6
                                                                                                                                        • Instruction Fuzzy Hash: 68C18FA2A1AA4684EB928BA5D8903BD37B0FB44B64F44C135CE6D573B0DFBDE445C740
                                                                                                                                        Function 00007FFBAB7A92F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9413
                                                                                                                                        • HeapFree.KERNEL32(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9426
                                                                                                                                        • WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,00000002,?,stderrstd\src\io\mod.rs,?,00007FFBAB793139), ref: 00007FFBAB7A9451
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$AddressSingleWake
                                                                                                                                        • String ID: stderrstd\src\io\mod.rs
                                                                                                                                        • API String ID: 2995119335-3161960892
                                                                                                                                        • Opcode ID: d0eefe2b9fd3d09767f88080a14ae0bad44f9d91b038c6c60c75e6cce6222d81
                                                                                                                                        • Instruction ID: 45f0bad4257c58a721d4ec71c4b604329aed07bb979dbd15dba2a7521fd77a75
                                                                                                                                        • Opcode Fuzzy Hash: d0eefe2b9fd3d09767f88080a14ae0bad44f9d91b038c6c60c75e6cce6222d81
                                                                                                                                        • Instruction Fuzzy Hash: 775184B2A0AB5185FB92CB75E8542BD37A4AB85B94F04C139DE2E437B4CFBCD4558340
                                                                                                                                        Function 00007FFBAB796980 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • attempted to fetch exception but none was set, xrefs: 00007FFBAB796A7C
                                                                                                                                        • could not append __name__ to __all__C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\types\module.rs, xrefs: 00007FFBAB796ADC
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: SubtypeType_
                                                                                                                                        • String ID: attempted to fetch exception but none was set$could not append __name__ to __all__C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pyo3-0.23.1\src\types\module.rs
                                                                                                                                        • API String ID: 2891779845-1166434468
                                                                                                                                        • Opcode ID: dffd98fa5628780ec5881b6b4853a392c58bf17c1e8a908027dcc362b4233bee
                                                                                                                                        • Instruction ID: e30dd8a70a8a0118b5bb2fc5daa805594bb7b5ef79f6ed922252aa008a1a6f8e
                                                                                                                                        • Opcode Fuzzy Hash: dffd98fa5628780ec5881b6b4853a392c58bf17c1e8a908027dcc362b4233bee
                                                                                                                                        • Instruction Fuzzy Hash: 01519F62E19A9189F712DB75D8407FC7770BB88368F04C635EEA912BB5EF78E5858300
                                                                                                                                        Function 00007FFBAB792220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyObject_GetAttr.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000002D), ref: 00007FFBAB792258
                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000002D), ref: 00007FFBAB792279
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttrObject_SubtypeType_
                                                                                                                                        • String ID: PyStringPyListutf-8$attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 3540899126-3053824340
                                                                                                                                        • Opcode ID: 23f7d9075be2292d58307072a0ac2a0dafde05a6c2187755f5f2dd5084d928d9
                                                                                                                                        • Instruction ID: 94ee054b6b1595b0e1d8ad4adbe8513b68d3858c4313d6abb11b46773605eff1
                                                                                                                                        • Opcode Fuzzy Hash: 23f7d9075be2292d58307072a0ac2a0dafde05a6c2187755f5f2dd5084d928d9
                                                                                                                                        • Instruction Fuzzy Hash: DA41427291AB8686E7529B25E4403AAB7A0FB85780F10C135DF9D43B74EFBDE585CB00
                                                                                                                                        Function 00007FFBAB7920F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,00000002,?,00000002,?,?,00007FFBAB792F67), ref: 00007FFBAB792207
                                                                                                                                          • Part of subcall function 00007FFBAB781620: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00000000,00000001,?,?,?,00000000,?), ref: 00007FFBAB781706
                                                                                                                                          • Part of subcall function 00007FFBAB781620: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00000000,00000001,?,?,?,00000000,?), ref: 00007FFBAB7817BE
                                                                                                                                        • memcpy.VCRUNTIME140(?,?,?,?,00000002,?,00000002,?,?,00007FFBAB792F67,?,?,?,?,00000002,?), ref: 00007FFBAB79219A
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy
                                                                                                                                        • String ID: surrogatepass$utf-8
                                                                                                                                        • API String ID: 3510742995-2708403489
                                                                                                                                        • Opcode ID: 8d1bfd50d60d39973946ea0ad81b97d10c3d7a732ac1f7739ec3a533893b64eb
                                                                                                                                        • Instruction ID: 863445fd40ead51925fe17f158c6ae03367144a0fa16a32f4b70a3a0e06c7436
                                                                                                                                        • Opcode Fuzzy Hash: 8d1bfd50d60d39973946ea0ad81b97d10c3d7a732ac1f7739ec3a533893b64eb
                                                                                                                                        • Instruction Fuzzy Hash: 1C31B0A2B0A64244FA16AB72E9001FC67616F48BE0F08C135DF6E077F6DEBCA5528700
                                                                                                                                        Function 00007FFBAB7991B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,00000004,?,00007FFBAB792D8A), ref: 00007FFBAB79924C
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,00000004,?,00007FFBAB792D8A), ref: 00007FFBAB799258
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004,?,00007FFBAB792D8A), ref: 00007FFBAB7992BC
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: normalized exception value missing
                                                                                                                                        • API String ID: 0-523065825
                                                                                                                                        • Opcode ID: cd73c5bf74466309a257b06cfd49f9676f961bcb042c615a155ab74f542897b4
                                                                                                                                        • Instruction ID: e32a8464a2fb3df893e0e36afb6db33e7c62bcbcb9a209c67bbc38c55da65ce2
                                                                                                                                        • Opcode Fuzzy Hash: cd73c5bf74466309a257b06cfd49f9676f961bcb042c615a155ab74f542897b4
                                                                                                                                        • Instruction Fuzzy Hash: 8F315C72B06B4298FB12DBB0E9453FC3770AB84798F448535DE6D13AA8DFB89295C300
                                                                                                                                        Function 00007FFBAB7A90F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: stderrstd\src\io\mod.rs
                                                                                                                                        • API String ID: 3298025750-3161960892
                                                                                                                                        • Opcode ID: 3a1ba8907b1c625a603600ae2facdef3fd3a9d2aef331a50e16570018614fd52
                                                                                                                                        • Instruction ID: 93cbf02015f712a942f8d26f734169f3df169e225d75aa84df732ef1c223597b
                                                                                                                                        • Opcode Fuzzy Hash: 3a1ba8907b1c625a603600ae2facdef3fd3a9d2aef331a50e16570018614fd52
                                                                                                                                        • Instruction Fuzzy Hash: 1B317772A06B5588EB92CB74D8543AC27B0BB44B58F40C53ACE6D537B8EF789445C340
                                                                                                                                        Function 00007FFBAB798330 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • )..0123456789abcdefBorrowMutErroralready borrowed: , xrefs: 00007FFBAB798437
                                                                                                                                        • ,]core\src\fmt\num.rs, xrefs: 00007FFBAB7983EB
                                                                                                                                        • NoneSomePyO3 modules compiled for CPython 3.8 or older may only be initialized once per interpreter process, xrefs: 00007FFBAB798411
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Bytes_FromSizeString
                                                                                                                                        • String ID: )..0123456789abcdefBorrowMutErroralready borrowed: $,]core\src\fmt\num.rs$NoneSomePyO3 modules compiled for CPython 3.8 or older may only be initialized once per interpreter process
                                                                                                                                        • API String ID: 4079093288-2358574722
                                                                                                                                        • Opcode ID: ff254e82d7d88e46e5dba89668802c9cc9d4d6bd113cc807dd57ad2e29c802fc
                                                                                                                                        • Instruction ID: 66b553b02f2835b0116c36698b1b1f439f4c6502f9e23ec0d806ee92d5d5ebf8
                                                                                                                                        • Opcode Fuzzy Hash: ff254e82d7d88e46e5dba89668802c9cc9d4d6bd113cc807dd57ad2e29c802fc
                                                                                                                                        • Instruction Fuzzy Hash: 7D3185E2A0D64585EBA28F35E0403AD6BA1FF98B84F449031DE9E037B4DFACD585CB00
                                                                                                                                        Function 00007FFBAB721DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _errnomemcpy
                                                                                                                                        • String ID: $:$f
                                                                                                                                        • API String ID: 3763079019-1417061885
                                                                                                                                        • Opcode ID: ce12fd19a0190e8d6ed2a2ad05ed0a10d4c44a0145acd63adbdf1cc73d5dbc78
                                                                                                                                        • Instruction ID: 021a8edcafeaee21541859baa6d50dddb20841da672d96a36369aded54e14430
                                                                                                                                        • Opcode Fuzzy Hash: ce12fd19a0190e8d6ed2a2ad05ed0a10d4c44a0145acd63adbdf1cc73d5dbc78
                                                                                                                                        • Instruction Fuzzy Hash: 7C316172A1978686E761DF70E4003BA7360FB98754F409236EE9C43AA9EFBCD584C700
                                                                                                                                        Function 00007FFBAB601EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFBAB601EDC), ref: 00007FFBAB603B35
                                                                                                                                          • Part of subcall function 00007FFBAB601FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB602008
                                                                                                                                          • Part of subcall function 00007FFBAB601FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB602026
                                                                                                                                        • PyErr_Format.PYTHON312 ref: 00007FFBAB601F53
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_strncmp$FormatString
                                                                                                                                        • String ID: name too long$undefined character name '%s'
                                                                                                                                        • API String ID: 3882229318-4056717002
                                                                                                                                        • Opcode ID: 715c9f25760f3b51f9c773b91e4e06c178d711229799cf52a99adf42e7180ef0
                                                                                                                                        • Instruction ID: 4a0ca9afae850a28b5ab66426ed91a3d5cc5b1bd2bcb8d27607a2511a110ee93
                                                                                                                                        • Opcode Fuzzy Hash: 715c9f25760f3b51f9c773b91e4e06c178d711229799cf52a99adf42e7180ef0
                                                                                                                                        • Instruction Fuzzy Hash: F41121B5E1A947A1EF018B2EDC942B4A3A1FB88748F80D431DE2D462B0DF7DD54ACB00
                                                                                                                                        Function 00007FFBB1891CD8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFBB1890B34), ref: 00007FFBB1891CE5
                                                                                                                                        • PyErr_Occurred.PYTHON312(?,?,00000006,00007FFBB1890B34), ref: 00007FFBB1891CEE
                                                                                                                                        • PyErr_SetString.PYTHON312(?,?,00000006,00007FFBB1890B34), ref: 00007FFBB1895DED
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Long$Long_OccurredStringUnsigned
                                                                                                                                        • String ID: Value too large for uint32_t type
                                                                                                                                        • API String ID: 944333170-1712686559
                                                                                                                                        • Opcode ID: 4134b6f324d143903defbd7246d51c475da5d791648b556bafad6f07a8abef05
                                                                                                                                        • Instruction ID: 18c3fc55eb776867f9a5c9ebf58b65d3ca9827227c223ce1ed2de638d1c09e1f
                                                                                                                                        • Opcode Fuzzy Hash: 4134b6f324d143903defbd7246d51c475da5d791648b556bafad6f07a8abef05
                                                                                                                                        • Instruction Fuzzy Hash: B4F058A0B0CA07C6EB005F39FC841382360BB4ABCCF646031CB0E46264DE3CE4858308
                                                                                                                                        Function 00007FFBB189625C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Long$Long_OccurredStringUnsigned
                                                                                                                                        • String ID: Value too large for lzma_mode type
                                                                                                                                        • API String ID: 944333170-1290617251
                                                                                                                                        • Opcode ID: fb5ddefca8d5b01e63416329e5ffe83b762c8ee1e522af1603897c3e45a3cdaa
                                                                                                                                        • Instruction ID: d323d55ef58d15663d9c5cf80d0b7e4e8a2c87fad2ff741bf4e4a2a6e9d844da
                                                                                                                                        • Opcode Fuzzy Hash: fb5ddefca8d5b01e63416329e5ffe83b762c8ee1e522af1603897c3e45a3cdaa
                                                                                                                                        • Instruction Fuzzy Hash: 28F0F8A1A19A47D6EF504FBAFD845386360BF49BC8F686475CB0E466A4CE3CE4948308
                                                                                                                                        Function 00007FFBB1896204 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Err_Long$Long_OccurredStringUnsigned
                                                                                                                                        • String ID: Value too large for lzma_match_finder type
                                                                                                                                        • API String ID: 944333170-1161044407
                                                                                                                                        • Opcode ID: 6f5be8f549f842b22704a619f76fd492b1a6522def76c3fcc9e9a37cab0e91a5
                                                                                                                                        • Instruction ID: 8e0142cf5e74f96605312aa670d772ffe56fe16955929fa16450dbe5d3b49424
                                                                                                                                        • Opcode Fuzzy Hash: 6f5be8f549f842b22704a619f76fd492b1a6522def76c3fcc9e9a37cab0e91a5
                                                                                                                                        • Instruction Fuzzy Hash: D8F01CA1B19A4796EF144FBAFC841382360BF49BCCF68A075CB1E46764DE3CE4948308
                                                                                                                                        Function 00007FFBAB788270 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 186memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • integer overflow when calculating buffer size, xrefs: 00007FFBAB78841E
                                                                                                                                        • usize overflow when calculating b64 lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs, xrefs: 00007FFBAB788401
                                                                                                                                        • Invalid UTF8, xrefs: 00007FFBAB788468
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: Invalid UTF8$integer overflow when calculating buffer size$usize overflow when calculating b64 lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs
                                                                                                                                        • API String ID: 3298025750-187600601
                                                                                                                                        • Opcode ID: 7ffb651ded51af766a20ca07bbab3ff72ad7d72faac5765c54837e1d9ccda010
                                                                                                                                        • Instruction ID: 76497306185b0940ce93c619233580ff76ec99b1bf22c9ffe3a497bbf6296d56
                                                                                                                                        • Opcode Fuzzy Hash: 7ffb651ded51af766a20ca07bbab3ff72ad7d72faac5765c54837e1d9ccda010
                                                                                                                                        • Instruction Fuzzy Hash: 2061C4A2F0AB4245FB238BB5E8057BD2BA0AB45794F048135DE6D17BF5DEBCA581C340
                                                                                                                                        Function 00007FFBAB783950 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 186memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        • usize overflow when calculating b64 lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs, xrefs: 00007FFBAB783AE1
                                                                                                                                        • integer overflow when calculating buffer sizeC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\engine\mod.rs, xrefs: 00007FFBAB783AFE
                                                                                                                                        • Invalid UTF8, xrefs: 00007FFBAB783B48
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID: Invalid UTF8$integer overflow when calculating buffer sizeC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\engine\mod.rs$usize overflow when calculating b64 lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs
                                                                                                                                        • API String ID: 3298025750-3768190207
                                                                                                                                        • Opcode ID: ecf1f7e04472b218a95abe7ded434e4c1d79650c8ca54894dbd0ae6b1d860dd8
                                                                                                                                        • Instruction ID: acab18f1a1ceb38d1a7f157fee043929948980c86a8afdf9fe36363a9da197e1
                                                                                                                                        • Opcode Fuzzy Hash: ecf1f7e04472b218a95abe7ded434e4c1d79650c8ca54894dbd0ae6b1d860dd8
                                                                                                                                        • Instruction Fuzzy Hash: 4B61E5A2F0A64145FB1387B9E8197B92BA0BB44754F048535EE6D177F5DEBCA081C340
                                                                                                                                        Function 00007FFBAB601FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: strncmp
                                                                                                                                        • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                        • API String ID: 1114863663-87138338
                                                                                                                                        • Opcode ID: 2595fa2025d07ddf98b647c638fd1ed7edd11107ba76c08aad6fbc153bf9cbc4
                                                                                                                                        • Instruction ID: b07aae1559c0d7ab94195f999df2252e4b50ba3da6e66026d3de931219c626b3
                                                                                                                                        • Opcode Fuzzy Hash: 2595fa2025d07ddf98b647c638fd1ed7edd11107ba76c08aad6fbc153bf9cbc4
                                                                                                                                        • Instruction Fuzzy Hash: CF6128B2B1924256EA668A3EEC4067AE252FF84B90F44E235EF6D476E4DF7CD5018700
                                                                                                                                        Function 00007FFBB1888120 Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1888155
                                                                                                                                          • Part of subcall function 00007FFBB18923D0: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFBB188816F,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1892407
                                                                                                                                          • Part of subcall function 00007FFBB18923D0: PyList_New.PYTHON312(?,?,?,00007FFBB188816F,?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB189241A
                                                                                                                                        • PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB188817C
                                                                                                                                        • PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1888195
                                                                                                                                        • _Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FFBB1887DD1), ref: 00007FFBB1888255
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2935988267-0
                                                                                                                                        • Opcode ID: f71fc91e22af730c25ee730b42891d1516146eb922a9d627c1363ebaa2deac9b
                                                                                                                                        • Instruction ID: b8b6313be20978c537ff5a6e067cb42b9387c425118a4a8bbe2393ebe0d3121e
                                                                                                                                        • Opcode Fuzzy Hash: f71fc91e22af730c25ee730b42891d1516146eb922a9d627c1363ebaa2deac9b
                                                                                                                                        • Instruction Fuzzy Hash: 78418EA6A39A4285EB649F39EC401B923A5FF8AB8CF744135DB0D47694CF38E481C348
                                                                                                                                        Function 00007FFBAB722140 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _errno$memset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1454687054-0
                                                                                                                                        • Opcode ID: 719a3cb1e2f02652edde56b1254a5ca2b3367a06a9ed92efd1c5311a81ae457c
                                                                                                                                        • Instruction ID: a5f5e9af46130b1c39cb7f8763b0c26cdeb97a5fcc52c1accfaaa2ff52b0953f
                                                                                                                                        • Opcode Fuzzy Hash: 719a3cb1e2f02652edde56b1254a5ca2b3367a06a9ed92efd1c5311a81ae457c
                                                                                                                                        • Instruction Fuzzy Hash: BF31A1B2E0E68286E6268B35E54036E7250BB41790F54C631EEAE47BF5DEBCD9418B00
                                                                                                                                        Function 00007FFBAB7994E0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FromSizeStringTuple_Unicode_$FreeHeapItem
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 604185568-0
                                                                                                                                        • Opcode ID: 8a84a2624ee731dffdc78ccdeb5676e5fcb58e02753667c4ad1df8b3d9e0648e
                                                                                                                                        • Instruction ID: 63b2e3400229d66aba13438472e386b99f2978e0e37ffc951e73aae66cb4bf52
                                                                                                                                        • Opcode Fuzzy Hash: 8a84a2624ee731dffdc78ccdeb5676e5fcb58e02753667c4ad1df8b3d9e0648e
                                                                                                                                        • Instruction Fuzzy Hash: D221C4A2B0B64698F6529B35DC451FC2720AF847D4F48C535DE2D077F9DE68E642C300
                                                                                                                                        Function 00007FFBAB796E30 Relevance: 6.1, APIs: 4, Instructions: 68memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap$FromSizeStringUnicode_
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 335933182-0
                                                                                                                                        • Opcode ID: 582bda12ee67f417542515ffef22beb56987d90d81d5bfe32eeb19a2f551e748
                                                                                                                                        • Instruction ID: 461510ede60e9b0cb1c36f68782ea66054134ba7c91eae29d4e39f325b7e2afd
                                                                                                                                        • Opcode Fuzzy Hash: 582bda12ee67f417542515ffef22beb56987d90d81d5bfe32eeb19a2f551e748
                                                                                                                                        • Instruction Fuzzy Hash: 7B217CB2A06B4198F7129B76E8541BC6764BB88BA4F48C231DE7E037B4DF78D482C200
                                                                                                                                        Function 00007FFBAB7A8AC8 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FormatFreeHandleHeapMessageModulememset
                                                                                                                                        • String ID: }((,]core\src\fmt\num.rs$kind$messageKindError
                                                                                                                                        • API String ID: 388167489-3704275599
                                                                                                                                        • Opcode ID: 0a7e8352980b2ff816f875608b1a650b3ac14343fb43e04fe57b022feb1016eb
                                                                                                                                        • Instruction ID: 21598f674505aeec63a3d4e2273d756253d3b506bc7d5dc2bb3798f6636db1db
                                                                                                                                        • Opcode Fuzzy Hash: 0a7e8352980b2ff816f875608b1a650b3ac14343fb43e04fe57b022feb1016eb
                                                                                                                                        • Instruction Fuzzy Hash: 6E2192A2F0A65284EB12CB75D4403B82BA0AB45B88F448139CE6D17B75DFBCD545C710
                                                                                                                                        Function 00007FFBAB7A8ACF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FormatFreeHandleHeapMessageModulememset
                                                                                                                                        • String ID: }((,]core\src\fmt\num.rs$kind$messageKindError
                                                                                                                                        • API String ID: 388167489-3704275599
                                                                                                                                        • Opcode ID: ae6d656bad1b811ea48f1a4a4bfb803ec5bb6253304dfa4828747b5eee0a23a0
                                                                                                                                        • Instruction ID: 07c6aa4ca0e18e503d085c8dfeb36896f4d2b012c1b9194cb2c807fecdf6debf
                                                                                                                                        • Opcode Fuzzy Hash: ae6d656bad1b811ea48f1a4a4bfb803ec5bb6253304dfa4828747b5eee0a23a0
                                                                                                                                        • Instruction Fuzzy Hash: 7221C3A2F0E65284EB12CB75E4403B82BA0AB45B88F44C13ACE6D17B75DFBCD589C710
                                                                                                                                        Function 00007FFBAB7A8995 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FormatFreeHandleHeapMessageModulememset
                                                                                                                                        • String ID: }((,]core\src\fmt\num.rs$kind$messageKindError
                                                                                                                                        • API String ID: 388167489-3704275599
                                                                                                                                        • Opcode ID: c8c58c7ead35984b8524aab02b52c3203dcbc5c0593db5c7c5efcd8faf6ebb74
                                                                                                                                        • Instruction ID: c3ac1be8bdb59ff7b748389ff11bfa9c34cf10e2ac2d82979e7813658851356f
                                                                                                                                        • Opcode Fuzzy Hash: c8c58c7ead35984b8524aab02b52c3203dcbc5c0593db5c7c5efcd8faf6ebb74
                                                                                                                                        • Instruction Fuzzy Hash: D321C3A2F0E65284EB12CB75E4403B82BA0AB45B88F44C13ACE6D17B75DFBCD589C710
                                                                                                                                        Function 00007FFBAB7A8844 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FormatFreeHandleHeapMessageModulememset
                                                                                                                                        • String ID: }((,]core\src\fmt\num.rs$kind$messageKindError
                                                                                                                                        • API String ID: 388167489-3704275599
                                                                                                                                        • Opcode ID: e81c6238b63a821a15642332c35d701d458436477a057f9b6ea2e07c40497602
                                                                                                                                        • Instruction ID: e33e513edf60b8f5b4f2ea76f626167f5a1b0a892f0e3135dd00e9d4fe3f3a38
                                                                                                                                        • Opcode Fuzzy Hash: e81c6238b63a821a15642332c35d701d458436477a057f9b6ea2e07c40497602
                                                                                                                                        • Instruction Fuzzy Hash: 7821A4A2F0E64284EB12CB75D4403B82B60AB45B88F448139CE6D17B75DFBCD545C710
                                                                                                                                        Function 00007FFBAB7A86EE Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FormatFreeHandleHeapMessageModulememset
                                                                                                                                        • String ID: }((,]core\src\fmt\num.rs$kind$messageKindError
                                                                                                                                        • API String ID: 388167489-3704275599
                                                                                                                                        • Opcode ID: 5dc8c7c40d1744d1b58076c13e78928b25cec84c2bf3df035fb15b0d93448224
                                                                                                                                        • Instruction ID: d69ec17d71c1018f1c65581267058b002d1cf97ac524a88914333333c6aa192a
                                                                                                                                        • Opcode Fuzzy Hash: 5dc8c7c40d1744d1b58076c13e78928b25cec84c2bf3df035fb15b0d93448224
                                                                                                                                        • Instruction Fuzzy Hash: 7321C3A2F0E65285EB12CB75E4403B82BA0AB45B88F44C13ACE6D17B75DFBCD589C710
                                                                                                                                        Function 00007FFBAB7386A0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFBAB738DB3), ref: 00007FFBAB7386D3
                                                                                                                                        • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFBAB738DB3), ref: 00007FFBAB7386FB
                                                                                                                                        • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFBAB738DB3), ref: 00007FFBAB738709
                                                                                                                                        • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFBAB738DB3), ref: 00007FFBAB738725
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: malloc$_errnofree
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1357609169-0
                                                                                                                                        • Opcode ID: 7d8c720e3c60430bfd876e5adbfadafc7c0b8202177fa9a4f57727d66cb38876
                                                                                                                                        • Instruction ID: 888b58820c151b1bc128719c61602d6395472c6732b7e64e26332acc5b5500c5
                                                                                                                                        • Opcode Fuzzy Hash: 7d8c720e3c60430bfd876e5adbfadafc7c0b8202177fa9a4f57727d66cb38876
                                                                                                                                        • Instruction Fuzzy Hash: 92115E76B06B0681EF4A8B75E55032936A1EB84BA4F44D130DA2C077F4EFBCD4518305
                                                                                                                                        Function 00007FFBB188748C Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: DeallocFreeMem_Thread_free_lock
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2783890233-0
                                                                                                                                        • Opcode ID: d428cfc036ba8db676b82ef3e8dfa2ae607f3e33f17c82aaa8392552ad353263
                                                                                                                                        • Instruction ID: 55dc0cdc67cbcdb753dff8790de12673e79fdd0a935575ce01f3f06496ed0496
                                                                                                                                        • Opcode Fuzzy Hash: d428cfc036ba8db676b82ef3e8dfa2ae607f3e33f17c82aaa8392552ad353263
                                                                                                                                        • Instruction Fuzzy Hash: 2F11F7A2A2D94282EB698F79ED943782770FF85B88F285031D71E465A0CF3CE4958308
                                                                                                                                        Function 00007FFBA96584E4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1556595335.00007FFBA90B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFBA90B0000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1556536733.00007FFBA90B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1557712622.00007FFBA9677000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1557898237.00007FFBA983B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1557961308.00007FFBA984A000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1557984120.00007FFBA984B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1558005224.00007FFBA984F000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffba90b0000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                        • Opcode ID: 482ef674be31a355f0017e669e564cf40bbc9000a1cd375260d82ff325400f61
                                                                                                                                        • Instruction ID: fa56dff966220617aa81d452c9d4d60b3775ec81c013e748d95e4844a8b46f44
                                                                                                                                        • Opcode Fuzzy Hash: 482ef674be31a355f0017e669e564cf40bbc9000a1cd375260d82ff325400f61
                                                                                                                                        • Instruction Fuzzy Hash: BD111C72B15B068AEB018F74EC542A833A4FB59758F441E31DE6D867A8DF78D1549340
                                                                                                                                        Function 00007FFBAB7B07A4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                        • Opcode ID: a145de6b187928486887365137a3516f9309c24e47bd1e2024e2830497425996
                                                                                                                                        • Instruction ID: 74ad6a737dcb442672eb8483b423ab8b7a123f1d00855f39d93db5194549e07d
                                                                                                                                        • Opcode Fuzzy Hash: a145de6b187928486887365137a3516f9309c24e47bd1e2024e2830497425996
                                                                                                                                        • Instruction Fuzzy Hash: DD111C72B19B018AEB018F70E8542B833A4FB59758F444E35DE6D467B4DFB8D1588780
                                                                                                                                        Function 00007FFBB189388C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                        • Opcode ID: ceb7ae2d9f8cbe6109bd19fcf6846f121611a23f4a42770b13db607f88bce10b
                                                                                                                                        • Instruction ID: 9eb4c54f1932301af7af5c01fb9c655a1e50c8e12e9f0343d2057dfc3da2197d
                                                                                                                                        • Opcode Fuzzy Hash: ceb7ae2d9f8cbe6109bd19fcf6846f121611a23f4a42770b13db607f88bce10b
                                                                                                                                        • Instruction Fuzzy Hash: 07114862B15F068AEB008F74EC442B833A4FB59798F041A31DB6D82BA4DF7CD1A88340
                                                                                                                                        Function 00007FFBAB797E50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 262COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        • 0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899core\src\fmt\mod.rs, xrefs: 00007FFBAB7980A0
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899core\src\fmt\mod.rs
                                                                                                                                        • API String ID: 0-3679759042
                                                                                                                                        • Opcode ID: 430505fd3401bbcb639c8f6a7735870f03053e167f1cd2ff658ff67654253c83
                                                                                                                                        • Instruction ID: f537d0f045e6d2e69dda701fb420b8be8ad4db75f04e7beb92939e7076f41328
                                                                                                                                        • Opcode Fuzzy Hash: 430505fd3401bbcb639c8f6a7735870f03053e167f1cd2ff658ff67654253c83
                                                                                                                                        • Instruction Fuzzy Hash: DB9112B2A0A65585EB568B39E4003BD6761EB84B90F44D235DE6E07BF0DE7CD541C700
                                                                                                                                        Function 00007FFBAB790F60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Repr
                                                                                                                                        • String ID: attempted to fetch exception but none was set
                                                                                                                                        • API String ID: 3495777991-3578100625
                                                                                                                                        • Opcode ID: c8b76b7aa7f13dc450e71678eb71cd88c846d3d7db24d7c10abffff595579938
                                                                                                                                        • Instruction ID: 1001b7062cfedbf58e6ba32380d51c515e5fb7b681ea8584c88da1f6acf3123b
                                                                                                                                        • Opcode Fuzzy Hash: c8b76b7aa7f13dc450e71678eb71cd88c846d3d7db24d7c10abffff595579938
                                                                                                                                        • Instruction Fuzzy Hash: AF516262A1D78182E7528B39E4412AAB7A0EFC5780F209135FF8D52B79EF7DD5818B00
                                                                                                                                        Function 00007FFBAB795BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,00007FFBAB7B38BA), ref: 00007FFBAB795C61
                                                                                                                                        • Py_DecRef.PYTHON3(?,?,?,?,?,?,?,?,?,00007FFBAB7B38BA), ref: 00007FFBAB795C74
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AddressSingleWake
                                                                                                                                        • String ID: called `Result::unwrap()` on an `Err` value
                                                                                                                                        • API String ID: 3114109732-2333694755
                                                                                                                                        • Opcode ID: cffb8628b92d9be1c5c725a4e89ecc8bf759cba8158eed26ccc56eaa4da1f525
                                                                                                                                        • Instruction ID: 302bb41a043ef1237f06fc9fc2b47c81900bc5b69211ef41363af7b438035145
                                                                                                                                        • Opcode Fuzzy Hash: cffb8628b92d9be1c5c725a4e89ecc8bf759cba8158eed26ccc56eaa4da1f525
                                                                                                                                        • Instruction Fuzzy Hash: EC418572A0A75241FBA38B35E4503BD27A05F45BA4F048135CEBE077F5DE7CA5468340
                                                                                                                                        Function 00007FFBAB7221E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: abort
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4206212132-3916222277
                                                                                                                                        • Opcode ID: 72170131c1776b4b504c476bea5d8f0ba6196989c8e6c62de83e771add799104
                                                                                                                                        • Instruction ID: 8a56f918b2ed46b4371da7d9d1af056b8cf49251f31816318042a0f068b1b845
                                                                                                                                        • Opcode Fuzzy Hash: 72170131c1776b4b504c476bea5d8f0ba6196989c8e6c62de83e771add799104
                                                                                                                                        • Instruction Fuzzy Hash: DA31C572E1E78282E6119B34D8003B97350EBA5764F609335EE6C067F1DFB9E6D28700
                                                                                                                                        Function 00007FFBAB787CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80threadCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • PyEval_SaveThread.PYTHON3(?,?,?,?,?,?,00000000,?,?,?,00007FFBAB786E1A), ref: 00007FFBAB787D0D
                                                                                                                                          • Part of subcall function 00007FFBAB7897A0: HeapFree.KERNEL32 ref: 00007FFBAB789922
                                                                                                                                        • PyEval_RestoreThread.PYTHON3(?,?,?,?,?,?,00000000,?,?,?,00007FFBAB786E1A), ref: 00007FFBAB787D70
                                                                                                                                        Strings
                                                                                                                                        • called `Result::unwrap()` on an `Err` valueInvalidParamLenInvalidRoundsInvalidOutputLenInvalidMemoryLen, xrefs: 00007FFBAB787DAE
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Eval_Thread$FreeHeapRestoreSave
                                                                                                                                        • String ID: called `Result::unwrap()` on an `Err` valueInvalidParamLenInvalidRoundsInvalidOutputLenInvalidMemoryLen
                                                                                                                                        • API String ID: 3072359887-2961443277
                                                                                                                                        • Opcode ID: 5ebca3f549972d30f7a2db2f14191adca781f91d4fe33e03cac2e4e05a4aaacf
                                                                                                                                        • Instruction ID: 5d3c104c87639b773f2106d3a5c056a4470ec408a7450789908adf17c02f1576
                                                                                                                                        • Opcode Fuzzy Hash: 5ebca3f549972d30f7a2db2f14191adca781f91d4fe33e03cac2e4e05a4aaacf
                                                                                                                                        • Instruction Fuzzy Hash: F3316D76A09A8999E602CF65E8402A83760F788BA4F44C232DE6D037B5DF78D59AC700
                                                                                                                                        Function 00007FFBAB7212F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: _errno
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2918714741-3916222277
                                                                                                                                        • Opcode ID: 693662198535a997ba725177c4a5cddab69ad3c048cae73c6cb0d00c3bef6fa8
                                                                                                                                        • Instruction ID: 1559aca09b70d41aca2c86425a31be88ac100fc171cc0a29ad3ed8ced14b4ef2
                                                                                                                                        • Opcode Fuzzy Hash: 693662198535a997ba725177c4a5cddab69ad3c048cae73c6cb0d00c3bef6fa8
                                                                                                                                        • Instruction Fuzzy Hash: 1221B162E2978586E6118B25E8003B97351FB95B54F109335EEAC06AF2EFF9D1D28700
                                                                                                                                        Function 00007FFBAB6025C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        • _PyObject_GC_New.PYTHON312(?,?,00000000,00007FFBAB602533), ref: 00007FFBAB6025C6
                                                                                                                                        • PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFBAB602533), ref: 00007FFBAB6025F8
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1565226985.00007FFBAB601000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFBAB600000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1565202427.00007FFBAB600000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB605000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB662000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6AE000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B2000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB6B7000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1565650695.00007FFBAB70F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566416241.00007FFBAB712000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566501964.00007FFBAB714000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab600000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: Object_$Track
                                                                                                                                        • String ID: 3.2.0
                                                                                                                                        • API String ID: 16854473-1786766648
                                                                                                                                        • Opcode ID: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
                                                                                                                                        • Instruction ID: e66b919a623814f9f69125a0f27135fa2e43275c4c4e7639ce04fc3aed7fe7dc
                                                                                                                                        • Opcode Fuzzy Hash: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
                                                                                                                                        • Instruction Fuzzy Hash: D6E0EDB5A17B02B1EE168B3AEC94069A3B4EF08704B54E135CD6D02370EF3CE164D240
                                                                                                                                        Function 00007FFBAB7AC3C0 Relevance: 5.3, APIs: 4, Instructions: 256COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: f7056ee17515975bcd689a07a73a34b05c6ff491fe82de4bc0ca5aa9aa1d9190
                                                                                                                                        • Instruction ID: 6840f5af5d48580a31b460bb2f8ce0b0252a6d3bdd18799fff64e4e4cd7bda8c
                                                                                                                                        • Opcode Fuzzy Hash: f7056ee17515975bcd689a07a73a34b05c6ff491fe82de4bc0ca5aa9aa1d9190
                                                                                                                                        • Instruction Fuzzy Hash: C8A1D5A2A06B4599EB42CB71EC443EC27A4BB44BA4F54853ADE6D077B4DFBCD186C300
                                                                                                                                        Function 00007FFBAB7290C0 Relevance: 5.1, APIs: 4, Instructions: 118COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 564c64ff5da7535877f889dcf58dfee16dfe61843f23f1487a9263a75782ecab
                                                                                                                                        • Instruction ID: 13ae6a6d09a7a93acf3f818dd247f4799eb617a401dbffa9cb32aa04cb1e688d
                                                                                                                                        • Opcode Fuzzy Hash: 564c64ff5da7535877f889dcf58dfee16dfe61843f23f1487a9263a75782ecab
                                                                                                                                        • Instruction Fuzzy Hash: F34166B2A0E6C185D6659F36E80036AB6D5FB84BD0F088135EEAD57BB9DF7CD4418B00
                                                                                                                                        Function 00007FFBAB788E60 Relevance: 5.1, APIs: 4, Instructions: 87memoryCOMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566902415.00007FFBAB781000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFBAB780000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566873710.00007FFBAB780000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566961770.00007FFBAB7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567005740.00007FFBAB7CA000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567045178.00007FFBAB7CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab780000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: FreeHeap
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3298025750-0
                                                                                                                                        • Opcode ID: c26af827d654cc72d80027a72dd23a74a6b6c98b7e2086bb1c3235f5ca3d2502
                                                                                                                                        • Instruction ID: 815f4595cfce08133d5c75b449c168412cc5445bd645f390b7a861ce99c1ece5
                                                                                                                                        • Opcode Fuzzy Hash: c26af827d654cc72d80027a72dd23a74a6b6c98b7e2086bb1c3235f5ca3d2502
                                                                                                                                        • Instruction Fuzzy Hash: 3B4148B2A15B4588EB06CBB1D8543BC27B1BB88B54F44853ACE6E577B4DFB89484C340
                                                                                                                                        Function 00007FFBB1889B10 Relevance: 5.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1567374083.00007FFBB1881000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFBB1880000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1567341242.00007FFBB1880000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB1898000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567430600.00007FFBB189C000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567519241.00007FFBB18A4000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1567558581.00007FFBB18A5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbb1880000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memcpy$memmove
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 1283327689-0
                                                                                                                                        • Opcode ID: 5747cb774df801cd35a75d75258c398830ded4cb658daab5d535697e58e83b2b
                                                                                                                                        • Instruction ID: ed9e47e24641769f8e9b0451c23c11683897cace75863adfdcce41e39a3f8f52
                                                                                                                                        • Opcode Fuzzy Hash: 5747cb774df801cd35a75d75258c398830ded4cb658daab5d535697e58e83b2b
                                                                                                                                        • Instruction Fuzzy Hash: F52122B2B28645C3D7109F3AE80406DB7A1FB54BD4B684139DF9E47B89CE79E442C748
                                                                                                                                        Function 00007FFBAB746C90 Relevance: 5.1, APIs: 4, Instructions: 78COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000002.00000002.1566578372.00007FFBAB721000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFBAB720000, based on PE: true
                                                                                                                                        • Associated: 00000002.00000002.1566532361.00007FFBAB720000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566646564.00007FFBAB763000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566715520.00007FFBAB771000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566747818.00007FFBAB772000.00000008.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566799947.00007FFBAB773000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        • Associated: 00000002.00000002.1566832211.00007FFBAB775000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_2_2_7ffbab720000_Ao8sixO8Om.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: memset
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2221118986-0
                                                                                                                                        • Opcode ID: dc1e3496e9f43c1f8d758627d69fd3420336f81251dfc41739d078de2e810cc2
                                                                                                                                        • Instruction ID: fa583b9c11d9c46f78f722aa063d114f9f095400e30e3ea49b99d2d7b72d82f7
                                                                                                                                        • Opcode Fuzzy Hash: dc1e3496e9f43c1f8d758627d69fd3420336f81251dfc41739d078de2e810cc2
                                                                                                                                        • Instruction Fuzzy Hash: D8317E72619AC192E726DB21E48069AB3A4FB88794F448035EFDC43B69DF7CD551CF40