Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DeltaX.exe

Overview

General Information

Sample name:DeltaX.exe
Analysis ID:1578142
MD5:8c02c616f0d561e49ae8c000c1c9bc7a
SHA1:9709433a4028348c3d1bd0f6684d97e5d949e9c0
SHA256:6dc4e9a65a2aa8622e224c4b1d55b5d1389143a3971a58c2393d20dc29f307b4
Tags:CoinMinerexeuser-sa6ta6ni6c
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to infect the boot sector
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • DeltaX.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\DeltaX.exe" MD5: 8C02C616F0D561E49AE8C000C1C9BC7A)
    • DeltaX.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\DeltaX.exe" MD5: 8C02C616F0D561E49AE8C000C1C9BC7A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: DeltaX.exeVirustotal: Detection: 8%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.4% probability
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA43A0 PyCFunction_NewEx,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,1_2_66FA43A0
Source: DeltaX.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32trace.pdb source: DeltaX.exe, 00000000.00000003.1708925728.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774855825.00007FFE10264000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pythoncom.pdb}},GCTL source: DeltaX.exe, 00000001.00000002.1773333690.00007FFE0144C000.00000002.00000001.01000000.0000000C.sdmp, pythoncom38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_ssl.pdb source: DeltaX.exe, 00000001.00000002.1774346844.00007FFE0EC2D000.00000002.00000001.01000000.00000011.sdmp, _ssl.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774669645.00007FFE101D9000.00000002.00000001.01000000.0000000F.sdmp, _socket.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\python3.pdb source: DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775421875.00007FFE11BB2000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb?? source: DeltaX.exe, 00000001.00000002.1771891248.00007FFE013B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775798175.00007FFE12E15000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32api.pdb source: DeltaX.exe, 00000001.00000002.1774548019.00007FFE0EC53000.00000002.00000001.01000000.0000000D.sdmp, win32api.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1d 10 Sep 2019built on: Mon Sep 16 11:00:37 2019 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: DeltaX.exe, 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\_win32sysloader.pdb source: DeltaX.exe, 00000000.00000003.1699183866.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\python38.pdb source: DeltaX.exe, 00000001.00000002.1769037884.00007FFDFB76D000.00000002.00000001.01000000.00000004.sdmp, python38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: DeltaX.exe, 00000001.00000002.1775307609.00007FFE11541000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774855825.00007FFE10264000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32api.pdb!! source: DeltaX.exe, 00000001.00000002.1774548019.00007FFE0EC53000.00000002.00000001.01000000.0000000D.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: DeltaX.exe, 00000000.00000003.1697696910.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775995653.00007FFE13205000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775016727.00007FFE1030E000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_queue.pdb source: DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775567682.00007FFE120C3000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_elementtree.pdb source: DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: DeltaX.exe, 00000000.00000003.1697539313.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775695544.00007FFE126EE000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pywintypes.pdb source: DeltaX.exe, 00000001.00000002.1775125523.00007FFE11511000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pywintypes.pdb** source: DeltaX.exe, 00000001.00000002.1775125523.00007FFE11511000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: DeltaX.exe, 00000001.00000002.1771891248.00007FFE013B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\select.pdb source: DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775896309.00007FFE130C3000.00000002.00000001.01000000.00000010.sdmp, select.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: DeltaX.exe, 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1769594405.00007FFE00825000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: DeltaX.exe, 00000000.00000003.1697539313.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775695544.00007FFE126EE000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: DeltaX.exe, 00000000.00000003.1697696910.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775995653.00007FFE13205000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pythoncom.pdb source: DeltaX.exe, 00000001.00000002.1773333690.00007FFE0144C000.00000002.00000001.01000000.0000000C.sdmp, pythoncom38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA85E0 FindFirstFileExW,FindClose,0_2_00007FF654CA85E0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA85E0 FindFirstFileExW,FindClose,1_2_00007FF654CA85E0
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F93330 strchr,WSAStartup,gethostbyname,socket,htons,ioctlsocket,ioctlsocket,connect,ioctlsocket,send,send,WSAGetLastError,closesocket,WSACleanup,SetLastError,recv,recv,closesocket,WSACleanup,strstr,toupper,strstr,toupper,toupper,toupper,toupper,strstr,memcmp,memcmp,_mktime64,gethostbyname,WSAGetLastError,WSAGetLastError,ioctlsocket,WSAGetLastError,WSAGetLastError,WSACleanup,SetLastError,WSAGetLastError,select,ioctlsocket,1_2_66F93330
Source: global trafficDNS traffic detected: DNS query: brave.com
Source: DeltaX.exe, 00000001.00000002.1766522050.000001A7902D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: DeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: DeltaX.exe, 00000001.00000003.1761432959.000001A78F65F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755723115.000001A78FA24000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759335177.000001A78FA2E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1763699919.000001A78F660000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761271260.000001A78FF0B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756626751.000001A78FA26000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758465727.000001A78FA29000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754932185.000001A78F65A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758192126.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757486091.000001A78FA28000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761105478.000001A78FF05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: DeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: DeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlEc
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759655073.000001A78FA5D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760073324.000001A78FA60000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlts
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759655073.000001A78FA5D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760073324.000001A78FA60000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlpF
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: DeltaX.exe, 00000001.00000002.1766522050.000001A7902D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758569140.000001A78FB38000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: DeltaX.exe, 00000001.00000003.1761417012.000001A78FB32000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764904259.000001A78FB33000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758818088.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758818088.000001A78FA90000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FA8F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764756491.000001A78FA90000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: DeltaX.exe, 00000001.00000003.1759120907.000001A78F607000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://json.org
Source: DeltaX.exe, 00000001.00000002.1766861189.000001A790410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0N
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ocsp.thawte.com0
Source: python38.dll.0.drString found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: DeltaX.exe, 00000001.00000003.1755270685.000001A78FEC3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754966477.000001A78FBD8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765197838.000001A78FBD9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760439389.000001A78FBD9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754518855.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758150457.000001A78FEC8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/V
Source: DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/i
Source: DeltaX.exe, 00000001.00000002.1765536273.000001A78FDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757391154.000001A78FF48000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF50000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757455382.000001A78FF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757391154.000001A78FF48000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF50000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757455382.000001A78FF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crldX
Source: DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755372402.000001A78F5E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758700404.000001A78F5FA000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759120907.000001A78F5FD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755372402.000001A78F5E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758700404.000001A78F5FA000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759120907.000001A78F5FD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: DeltaX.exe, 00000001.00000003.1754788522.000001A78F688000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759212930.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757264882.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758628205.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755486890.000001A78F68C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756530762.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766070477.000001A78FF75000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: DeltaX.exe, 00000001.00000003.1754788522.000001A78F688000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759212930.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757264882.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758628205.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755486890.000001A78F68C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756530762.000001A78F68D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/n
Source: DeltaX.exe, 00000001.00000003.1757745656.000001A78FF95000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761207999.000001A78FFA5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758010409.000001A78FF98000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766194456.000001A78FFB3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757503305.000001A78FF94000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757152144.000001A78FFAE000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766158101.000001A78FFA8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758890361.000001A78FA79000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: DeltaX.exe, 00000001.00000002.1765663765.000001A78FEC1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714163997.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713551488.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713925480.000001A78D490000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713779399.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/
Source: DeltaX.exe, 00000000.00000003.1709738620.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764130223.000001A78F7D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: DeltaX.exe, 00000001.00000002.1763197818.000001A78F550000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713254959.000001A78D4D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713095449.000001A78D4D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: DeltaX.exe, 00000001.00000002.1765816879.000001A78FF09000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758192126.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761105478.000001A78FF05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: DeltaX.exe, 00000001.00000003.1755270685.000001A78FEC3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758150457.000001A78FEC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: DeltaX.exe, 00000001.00000002.1765816879.000001A78FF09000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758192126.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761105478.000001A78FF05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps=
Source: DeltaX.exe, 00000001.00000003.1757728184.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758786155.000001A78FBD4000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759429791.000001A78FBD6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754518855.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: DeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://brave.com/api/webhooks/123
Source: DeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://brave.com/api/webhooks/1230)Q
Source: DeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://brave.com/api/webhooks/123p%Q
Source: DeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://brave.com/api/webhooks/123te
Source: DeltaX.exe, 00000001.00000002.1764370950.000001A78F940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756412026.000001A78FBB1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766398569.000001A790032000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759615246.000001A790032000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/giK?t
Source: DeltaX.exe, 00000001.00000003.1759365816.000001A79003B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766417726.000001A790042000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760874035.000001A79003E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: DeltaX.exe, DeltaX.exe, 00000001.00000002.1775167367.00007FFE11522000.00000002.00000001.01000000.00000008.sdmp, DeltaX.exe, 00000001.00000002.1774604729.00007FFE0EC61000.00000002.00000001.01000000.0000000D.sdmp, DeltaX.exe, 00000001.00000002.1774049119.00007FFE01494000.00000002.00000001.01000000.0000000C.sdmp, win32api.pyd.0.dr, pythoncom38.dll.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.drString found in binary or memory: https://github.com/mhammond/pywin32
Source: DeltaX.exe, 00000001.00000002.1766602794.000001A790350000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
Source: DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762949765.000001A78F1D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: DeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1763368434.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1763368434.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: DeltaX.exe, 00000001.00000002.1764370950.000001A78F940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759598297.000001A78D4E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755328581.000001A78D4D2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759446724.000001A78D4E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755907138.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: DeltaX.exe, 00000001.00000002.1765504074.000001A78FDA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/32902
Source: DeltaX.exe, 00000001.00000003.1755871525.000001A78F607000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755158982.000001A78F607000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757831705.000001A78F629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urlliby
Source: DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760804885.000001A78D4C7000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762658774.000001A78D4CC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: DeltaX.exe, 00000001.00000003.1757831705.000001A78F629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: DeltaX.exe, 00000001.00000003.1758419753.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765003307.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: DeltaX.exe, 00000001.00000002.1765536273.000001A78FDE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: DeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: DeltaX.exe, 00000001.00000002.1765663765.000001A78FEC1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714163997.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713551488.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713925480.000001A78D490000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713779399.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765504074.000001A78FDA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: DeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/12kav.json
Source: DeltaX.exe, 00000001.00000002.1766602794.000001A790350000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: DeltaX.exe, 00000001.00000003.1759365816.000001A79003B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766417726.000001A790042000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760874035.000001A79003E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: DeltaX.exe, 00000001.00000003.1758419753.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765003307.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758569140.000001A78FB38000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759159899.000001A78FB3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: DeltaX.exe, 00000001.00000002.1765370865.000001A78FCD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: DeltaX.exe, 00000001.00000002.1765339924.000001A78FC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: https://www.digicert.com/CPS0
Source: DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmp, DeltaX.exe, 00000001.00000002.1772648557.00007FFE013E8000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://www.openssl.org/H
Source: DeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: DeltaX.exe, 00000001.00000003.1760647399.000001A78D4E5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755328581.000001A78D4D2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759446724.000001A78D4E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755907138.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757944935.000001A78FF8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760804885.000001A78D4C7000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762658774.000001A78D4CC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F93050 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,1_2_66F93050
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F92240: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy,1_2_66F92240
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA8C600_2_00007FF654CA8C60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CABE200_2_00007FF654CABE20
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA25600_2_00007FF654CA2560
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CAB2A00_2_00007FF654CAB2A0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA96400_2_00007FF654CA9640
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA96600_2_00007FF654CA9660
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CB508A0_2_00007FF654CB508A
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA94580_2_00007FF654CA9458
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F875601_2_66F87560
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F865601_2_66F86560
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F93B901_2_66F93B90
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA36F01_2_66FA36F0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD96A01_2_66FD96A0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FE76501_2_66FE7650
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA66401_2_66FA6640
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FAC6201_2_66FAC620
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD74F51_2_66FD74F5
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD64501_2_66FD6450
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F945C01_2_66F945C0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA05A01_2_66FA05A0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA95601_2_66FA9560
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA45201_2_66FA4520
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FAE2301_2_66FAE230
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F953B01_2_66F953B0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F973701_2_66F97370
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA80E01_2_66FA80E0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F971D01_2_66F971D0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F9B1701_2_66F9B170
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FE71701_2_66FE7170
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA91401_2_66FA9140
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F81E101_2_66F81E10
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FAAFE01_2_66FAAFE0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FADFB01_2_66FADFB0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD7F101_2_66FD7F10
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F9FCE01_2_66F9FCE0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FFECA01_2_66FFECA0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F89C601_2_66F89C60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FC1C501_2_66FC1C50
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD6C101_2_66FD6C10
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FE7D701_2_66FE7D70
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F87D601_2_66F87D60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F93D101_2_66F93D10
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F83AC11_2_66F83AC1
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F89AA01_2_66F89AA0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FD8A301_2_66FD8A30
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FC8A201_2_66FC8A20
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA7BF01_2_66FA7BF0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F838D61_2_66F838D6
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FC18C21_2_66FC18C2
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F978901_2_66F97890
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F908321_2_66F90832
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_670009D01_2_670009D0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F968101_2_66F96810
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FA78001_2_66FA7800
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FE09F01_2_66FE09F0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CABE201_2_00007FF654CABE20
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA25601_2_00007FF654CA2560
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA96401_2_00007FF654CA9640
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA96601_2_00007FF654CA9660
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CB508A1_2_00007FF654CB508A
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CAB2A01_2_00007FF654CAB2A0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA8C601_2_00007FF654CA8C60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA94581_2_00007FF654CA9458
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB26FB701_2_00007FFDFB26FB70
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1312C11_2_00007FFDFB1312C1
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB363B801_2_00007FFDFB363B80
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1340251_2_00007FFDFB134025
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2CBA701_2_00007FFDFB2CBA70
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB19FB001_2_00007FFDFB19FB00
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13385F1_2_00007FFDFB13385F
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB134B241_2_00007FFDFB134B24
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB133C1A1_2_00007FFDFB133C1A
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1325041_2_00007FFDFB132504
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB132BC61_2_00007FFDFB132BC6
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13513C1_2_00007FFDFB13513C
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2DFF801_2_00007FFDFB2DFF80
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB25BFA01_2_00007FFDFB25BFA0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2C7E701_2_00007FFDFB2C7E70
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1371941_2_00007FFDFB137194
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13135C1_2_00007FFDFB13135C
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB14BF201_2_00007FFDFB14BF20
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB14BD601_2_00007FFDFB14BD60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13200E1_2_00007FFDFB13200E
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131B951_2_00007FFDFB131B95
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1348CC1_2_00007FFDFB1348CC
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB132A271_2_00007FFDFB132A27
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB14F2001_2_00007FFDFB14F200
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB134B741_2_00007FFDFB134B74
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1352271_2_00007FFDFB135227
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1325131_2_00007FFDFB132513
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB14F0601_2_00007FFDFB14F060
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB133EB31_2_00007FFDFB133EB3
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131B721_2_00007FFDFB131B72
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1318891_2_00007FFDFB131889
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1311DB1_2_00007FFDFB1311DB
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13282E1_2_00007FFDFB13282E
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB15B8501_2_00007FFDFB15B850
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB133DBE1_2_00007FFDFB133DBE
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1346511_2_00007FFDFB134651
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB25B6001_2_00007FFDFB25B600
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB15B4C01_2_00007FFDFB15B4C0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2C74F01_2_00007FFDFB2C74F0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB135B911_2_00007FFDFB135B91
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1367171_2_00007FFDFB136717
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1360D71_2_00007FFDFB1360D7
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB133EA41_2_00007FFDFB133EA4
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1312A81_2_00007FFDFB1312A8
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1352041_2_00007FFDFB135204
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1369F61_2_00007FFDFB1369F6
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131AE11_2_00007FFDFB131AE1
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131EB01_2_00007FFDFB131EB0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB21A8701_2_00007FFDFB21A870
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13105F1_2_00007FFDFB13105F
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131F731_2_00007FFDFB131F73
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2CA9101_2_00007FFDFB2CA910
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1365961_2_00007FFDFB136596
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1321121_2_00007FFDFB132112
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1351D71_2_00007FFDFB1351D7
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1326711_2_00007FFDFB132671
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB25EE801_2_00007FFDFB25EE80
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB14EF001_2_00007FFDFB14EF00
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1360DC1_2_00007FFDFB1360DC
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1334AE1_2_00007FFDFB1334AE
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB26EDB01_2_00007FFDFB26EDB0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB131BC71_2_00007FFDFB131BC7
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1324AA1_2_00007FFDFB1324AA
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2124101_2_00007FFDFB212410
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1369151_2_00007FFDFB136915
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB134DA41_2_00007FFDFB134DA4
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1330991_2_00007FFDFB133099
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB132D601_2_00007FFDFB132D60
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1344211_2_00007FFDFB134421
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1319D81_2_00007FFDFB1319D8
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1360001_2_00007FFDFB136000
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13258B1_2_00007FFDFB13258B
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB2667101_2_00007FFDFB266710
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB1341291_2_00007FFDFB134129
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB132B2B1_2_00007FFDFB132B2B
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB13654B1_2_00007FFDFB13654B
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB134E7B1_2_00007FFDFB134E7B
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FF654CA2CD0 appears 92 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB135DDA appears 347 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 67022C70 appears 48 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB13206D appears 52 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB131C08 appears 69 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FF654CA2DB0 appears 200 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB131055 appears 737 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB134688 appears 86 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 67022C28 appears 65 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FFDFB1340F7 appears 210 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 00007FF654CA2E50 appears 34 times
Source: C:\Users\user\Desktop\DeltaX.exeCode function: String function: 66F9D070 appears 235 times
Source: pyarmor_runtime.pyd.0.drStatic PE information: Number of sections : 11 > 10
Source: DeltaX.exeStatic PE information: Number of sections : 12 > 10
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ha vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1708925728.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1697539313.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython38.dll. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1709241058.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1707743124.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes38.dll0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_elementtree.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1699210158.000001A974FAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1708784563.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1707437058.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom38.dll0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1699183866.000001A974FAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1697696910.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000000.00000003.1699183866.000001A974FA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs DeltaX.exe
Source: DeltaX.exeBinary or memory string: OriginalFilename vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775604875.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775167367.00007FFE11522000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilenamepywintypes38.dll0 vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775380845.00007FFE1154C000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775053670.00007FFE10314000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1769517956.00007FFDFB87F000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython38.dll. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775933031.00007FFE130C6000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1774604729.00007FFE0EC61000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1774049119.00007FFE01494000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamepythoncom38.dll0 vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1770016093.00007FFE0082B000.00000002.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775736854.00007FFE126F3000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775421875.00007FFE11BB2000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1775839558.00007FFE12E1A000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1776034544.00007FFE13209000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1774946032.00007FFE1026C000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1774718889.00007FFE101E3000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1774456970.00007FFE0EC3C000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs DeltaX.exe
Source: DeltaX.exe, 00000001.00000002.1772648557.00007FFE013E8000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenamelibsslH vs DeltaX.exe
Source: classification engineClassification label: mal56.winEXE@3/34@1/1
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA7E50 FormatMessageW,WideCharToMultiByte,GetLastError,0_2_00007FF654CA7E50
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442Jump to behavior
Source: DeltaX.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DeltaX.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: DeltaX.exeVirustotal: Detection: 8%
Source: C:\Users\user\Desktop\DeltaX.exeFile read: C:\Users\user\Desktop\DeltaX.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\DeltaX.exe "C:\Users\user\Desktop\DeltaX.exe"
Source: C:\Users\user\Desktop\DeltaX.exeProcess created: C:\Users\user\Desktop\DeltaX.exe "C:\Users\user\Desktop\DeltaX.exe"
Source: C:\Users\user\Desktop\DeltaX.exeProcess created: C:\Users\user\Desktop\DeltaX.exe "C:\Users\user\Desktop\DeltaX.exe"Jump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: libffi-7.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: libcrypto-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: libssl-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: python3.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: DeltaX.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: DeltaX.exeStatic file information: File size 10374703 > 1048576
Source: DeltaX.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32trace.pdb source: DeltaX.exe, 00000000.00000003.1708925728.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774855825.00007FFE10264000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pythoncom.pdb}},GCTL source: DeltaX.exe, 00000001.00000002.1773333690.00007FFE0144C000.00000002.00000001.01000000.0000000C.sdmp, pythoncom38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_ssl.pdb source: DeltaX.exe, 00000001.00000002.1774346844.00007FFE0EC2D000.00000002.00000001.01000000.00000011.sdmp, _ssl.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774669645.00007FFE101D9000.00000002.00000001.01000000.0000000F.sdmp, _socket.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\python3.pdb source: DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775421875.00007FFE11BB2000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb?? source: DeltaX.exe, 00000001.00000002.1771891248.00007FFE013B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775798175.00007FFE12E15000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32api.pdb source: DeltaX.exe, 00000001.00000002.1774548019.00007FFE0EC53000.00000002.00000001.01000000.0000000D.sdmp, win32api.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1d 10 Sep 2019built on: Mon Sep 16 11:00:37 2019 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: DeltaX.exe, 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\_win32sysloader.pdb source: DeltaX.exe, 00000000.00000003.1699183866.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\python38.pdb source: DeltaX.exe, 00000001.00000002.1769037884.00007FFDFB76D000.00000002.00000001.01000000.00000004.sdmp, python38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: DeltaX.exe, 00000001.00000002.1775307609.00007FFE11541000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1774855825.00007FFE10264000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32api.pdb!! source: DeltaX.exe, 00000001.00000002.1774548019.00007FFE0EC53000.00000002.00000001.01000000.0000000D.sdmp, win32api.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: DeltaX.exe, 00000000.00000003.1697696910.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775995653.00007FFE13205000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775016727.00007FFE1030E000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_queue.pdb source: DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775567682.00007FFE120C3000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\_elementtree.pdb source: DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.amd64.pdbGCTL source: DeltaX.exe, 00000000.00000003.1697539313.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775695544.00007FFE126EE000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pywintypes.pdb source: DeltaX.exe, 00000001.00000002.1775125523.00007FFE11511000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pywintypes.pdb** source: DeltaX.exe, 00000001.00000002.1775125523.00007FFE11511000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: DeltaX.exe, 00000001.00000002.1771891248.00007FFE013B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\select.pdb source: DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775896309.00007FFE130C3000.00000002.00000001.01000000.00000010.sdmp, select.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: DeltaX.exe, 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: DeltaX.exe, 00000000.00000003.1708141296.000001A974FA8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1769594405.00007FFE00825000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: vcruntime140.amd64.pdb source: DeltaX.exe, 00000000.00000003.1697539313.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775695544.00007FFE126EE000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: DeltaX.exe, 00000000.00000003.1697696910.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1775995653.00007FFE13205000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-38\Release\pythoncom.pdb source: DeltaX.exe, 00000001.00000002.1773333690.00007FFE0144C000.00000002.00000001.01000000.0000000C.sdmp, pythoncom38.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr
Source: VCRUNTIME140_1.dll.0.drStatic PE information: 0xFAEA9D3D [Sun May 27 03:27:57 2103 UTC]
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA15E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF654CA15E0
Source: md__mypyc.cp38-win_amd64.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x25d58
Source: _win32sysloader.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0xb07b
Source: win32trace.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x145f4
Source: pyarmor_runtime.pyd.0.drStatic PE information: real checksum: 0xa7ade should be: 0xa0dc7
Source: md.cp38-win_amd64.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0xb550
Source: win32api.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x30505
Source: pythoncom38.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xb0750
Source: _psutil_windows.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x1f645
Source: pywintypes38.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x27641
Source: win32ui.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x11b4b8
Source: DeltaX.exeStatic PE information: section name: /4
Source: DeltaX.exeStatic PE information: section name: .xdata
Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: mfc140u.dll.0.drStatic PE information: section name: .didat
Source: pyarmor_runtime.pyd.0.drStatic PE information: section name: .xdata

Persistence and Installation Behavior

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\DeltaX.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d1_2_66F92240
Source: C:\Users\user\Desktop\DeltaX.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d1_2_66F91E90
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_elementtree.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pywintypes38.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pythoncom38.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000\pyarmor_runtime.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\libffi-7.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73442\python38.dllJump to dropped file

Boot Survival

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\DeltaX.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d1_2_66F92240
Source: C:\Users\user\Desktop\DeltaX.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d1_2_66F91E90
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA4410 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF654CA4410
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_elementtree.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pywintypes38.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\python38.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pythoncom38.dllJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000\pyarmor_runtime.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\DeltaX.exeAPI coverage: 3.5 %
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA85E0 FindFirstFileExW,FindClose,0_2_00007FF654CA85E0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA85E0 FindFirstFileExW,FindClose,1_2_00007FF654CA85E0
Source: DeltaX.exe, 00000000.00000003.1710151642.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.drBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: DeltaX.exe, 00000001.00000003.1754788522.000001A78F688000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759212930.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757264882.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758628205.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755486890.000001A78F68C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756530762.000001A78F68D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWv
Source: DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760647399.000001A78D4D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756236255.000001A78D4D3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755328581.000001A78D4D2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759285894.000001A78D4D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: cacert.pem.0.drBinary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: C:\Users\user\Desktop\DeltaX.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F82C80 PyEval_GetGlobals,PyFunction_NewWithQualName,_PyObject_CallFunction_SizeT,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,GetProcAddress,strlen,IsDebuggerPresent,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_SystemExit,PyExc_SystemExit,PyExc_SystemExit,_errno,_errno,_errno,PyExc_SystemExit,_errno,_errno,_Py_Dealloc,_Py_Dealloc,1_2_66F82C80
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA15E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF654CA15E0
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66F945C0 GetComputerNameA,GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersAddresses,HeapFree,strlen,GetProcessHeap,HeapFree,malloc,GetAdaptersAddresses,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,RegOpenKeyExA,RegEnumKeyExA,RegEnumKeyExA,RegGetValueA,strlen,memcmp,RegGetValueA,RegCloseKey,1_2_66F945C0
Source: C:\Users\user\Desktop\DeltaX.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 0_2_00007FF654CA1154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,0_2_00007FF654CA1154
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FFF770 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,1_2_66FFF770
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FF654CA1154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,1_2_00007FF654CA1154
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_00007FFDFB134FDE __scrt_fastfail,IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFB134FDE
Source: C:\Users\user\Desktop\DeltaX.exeProcess created: C:\Users\user\Desktop\DeltaX.exe "C:\Users\user\Desktop\DeltaX.exe"Jump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pywintypes38.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\kyojenit VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp4i57dvwl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pythoncom38.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\win32api.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp38-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp38-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\certifi\cacert.pem VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp4i57dvwl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp4i57dvwl\gen_py\__init__.py VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp4i57dvwl\gen_py\dicts.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\Desktop\DeltaX.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp4i57dvwl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\DeltaX.exeCode function: 1_2_66FFF690 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,1_2_66FFF690
Source: C:\Users\user\Desktop\DeltaX.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
Bootkit		11
Process Injection		11
Process Injection		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		22
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Bootkit		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput Capture2
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Timestomp		LSA Secrets13
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
DeltaX.exe8%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_elementtree.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\_win32sysloader.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp38-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp38-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\libffi-7.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\libssl-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\mfc140u.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\psutil\_psutil_windows.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\pyexpat.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\python38.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pythoncom38.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pywintypes38.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\win32api.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\win32trace.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73442\win32ui.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://repository.swisssign.com/V0%Avira URL Cloudsafe
http://repository.swisssign.com/i0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
brave.com
54.230.112.122
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://google.com/DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758569140.000001A78FB38000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://mahler:8092/site-updates.pyDeltaX.exe, 00000001.00000002.1765663765.000001A78FEC1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714163997.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713551488.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713925480.000001A78D490000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713779399.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://crl.securetrust.com/SGCA.crlDeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://github.com/giampaolo/psutil/issues/875.DeltaX.exe, 00000001.00000003.1759365816.000001A79003B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766417726.000001A790042000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760874035.000001A79003E000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://.../back.jpegDeltaX.exe, 00000001.00000002.1766522050.000001A7902D0000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              http://www.python.org/DeltaX.exe, 00000001.00000002.1765663765.000001A78FEC1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714163997.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713551488.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713925480.000001A78D490000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713779399.000001A78D4EC000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://github.com/mhammond/pywin32DeltaX.exe, DeltaX.exe, 00000001.00000002.1775167367.00007FFE11522000.00000002.00000001.01000000.00000008.sdmp, DeltaX.exe, 00000001.00000002.1774604729.00007FFE0EC61000.00000002.00000001.01000000.0000000D.sdmp, DeltaX.exe, 00000001.00000002.1774049119.00007FFE01494000.00000002.00000001.01000000.0000000C.sdmp, win32api.pyd.0.dr, pythoncom38.dll.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.drfalse
                  		high
                  https://httpbin.org/postDeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/Ousret/charset_normalizerDeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756412026.000001A78FBB1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://www.firmaprofesional.com/cps0DeltaX.exe, 00000001.00000003.1757745656.000001A78FF95000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761207999.000001A78FFA5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758010409.000001A78FF98000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766194456.000001A78FFB3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757503305.000001A78FF94000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757152144.000001A78FFAE000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766158101.000001A78FFA8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1763368434.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/urllib3/urllib3/issues/2920DeltaX.exe, 00000001.00000002.1765504074.000001A78FDA0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://crl.securetrust.com/SGCA.crl0DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759655073.000001A78FA5D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760073324.000001A78FA60000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://www.python.org/download/releases/2.3/mro/.DeltaX.exe, 00000001.00000002.1763197818.000001A78F550000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713254959.000001A78D4D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1713095449.000001A78D4D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/giK?tDeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766398569.000001A790032000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759615246.000001A790032000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://yahoo.com/DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760804885.000001A78D4C7000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762658774.000001A78D4CC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://crl.securetrust.com/STCA.crl0DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759655073.000001A78FA5D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760073324.000001A78FA60000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://goo.gl/zeJZl.DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://tools.ietf.org/html/rfc2388#section-4.4DeltaX.exe, 00000001.00000003.1758419753.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765003307.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.securetrust.com/SGCA.crltsDeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6DeltaX.exe, 00000001.00000003.1756095628.000001A78FA59000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756046392.000001A78FA3C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758890361.000001A78FA79000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.quovadisglobal.com/cps=DeltaX.exe, 00000001.00000002.1765816879.000001A78FF09000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758192126.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761105478.000001A78FF05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://crl.thawte.com/ThawteTimestampingCA.crl0DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drfalse
                                                  		high
                                                  https://html.spec.whatwg.org/multipage/DeltaX.exe, 00000001.00000003.1758419753.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765003307.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FB7A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.quovadisglobal.com/cps0DeltaX.exe, 00000001.00000003.1755270685.000001A78FEC3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758150457.000001A78FEC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlDeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757391154.000001A78FF48000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF50000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757455382.000001A78FF4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsDeltaX.exe, 00000001.00000002.1765339924.000001A78FC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.rfc-editor.org/rfc/rfc8259#section-8.1DeltaX.exe, 00000001.00000003.1760647399.000001A78D4E5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755328581.000001A78D4D2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759446724.000001A78D4E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755907138.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://repository.swisssign.com/iDeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963DeltaX.exe, 00000001.00000002.1764370950.000001A78F940000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://brave.com/api/webhooks/123DeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://requests.readthedocs.ioDeltaX.exe, 00000001.00000002.1766602794.000001A790350000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://crl.securetrust.com/STCA.crlpFDeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://crl.dhimyotis.com/certignarootca.crlDeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://curl.haxx.se/rfc/cookie_spec.htmlDeltaX.exe, 00000001.00000002.1766522050.000001A7902D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://ocsp.accv.esDeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.python.org/dev/peps/pep-0205/DeltaX.exe, 00000000.00000003.1709738620.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764130223.000001A78F7D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://brave.com/api/webhooks/123p%QDeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://repository.swisssign.com/VDeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://repository.swisssign.com/DeltaX.exe, 00000001.00000003.1755270685.000001A78FEC3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754966477.000001A78FBD8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765197838.000001A78FBD9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760439389.000001A78FBD9000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754518855.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758150457.000001A78FEC8000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757679214.000001A78FF20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://json.orgDeltaX.exe, 00000001.00000003.1759120907.000001A78F607000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyDeltaX.exe, 00000001.00000002.1765370865.000001A78FCD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688DeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762949765.000001A78F1D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://python.org/dev/peps/pep-0263/python38.dll.0.drfalse
                                                                                          		high
                                                                                          https://httpbin.org/getDeltaX.exe, 00000001.00000002.1765536273.000001A78FDE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://crl.xrampsecurity.com/XGCA.crlDeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.cert.fnmt.es/dpcs/nDeltaX.exe, 00000001.00000003.1754788522.000001A78F688000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759212930.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757264882.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758628205.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755486890.000001A78F68C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756530762.000001A78F68D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.python.orgDeltaX.exe, 00000001.00000002.1764490843.000001A78FA10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.accv.es/legislacion_c.htm0UDeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://wwww.certigna.fr/autorites/0mDeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://ocsp.accv.es0DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://ocsp.thawte.com0DeltaX.exe, 00000000.00000003.1708141296.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698583518.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700506254.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699773414.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698843890.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1706429326.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705910155.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698369792.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698206159.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698686581.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1697794468.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1705738829.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1699057229.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1707918613.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000000.00000003.1698935972.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drfalse
                                                                                                          		high
                                                                                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerDeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1763368434.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://mail.python.org/pipermail/python-dev/2012-June/120787.html.DeltaX.exe, 00000001.00000002.1766861189.000001A790410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://httpbin.org/DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://wwww.certigna.fr/autorites/DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757944935.000001A78FF8F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://twitter.com/DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758569140.000001A78FB38000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759159899.000001A78FB3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://stackoverflow.com/questions/4457745#4457745.DeltaX.exe, 00000001.00000003.1759365816.000001A79003B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758943333.000001A790022000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766904404.000001A790450000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758261157.000001A790011000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755781066.000001A790009000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754428082.000001A78FFF1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766417726.000001A790042000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756731502.000001A79000F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760874035.000001A79003E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.quovadisglobal.com/cpsDeltaX.exe, 00000001.00000002.1765816879.000001A78FF09000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758192126.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF00000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761105478.000001A78FF05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535DeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758818088.000001A78FA90000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FA8F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764756491.000001A78FA90000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syDeltaX.exe, 00000001.00000003.1711483457.000001A78D5D5000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1761169246.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712793757.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712923053.000001A78D46D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756591004.000001A78D47D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759497477.000001A78D47E000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1714403326.000001A78D5D1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762500518.000001A78D47F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712623533.000001A78D485000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1711569935.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755393075.000001A78D457000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712037466.000001A78D486000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1712202345.000001A78D485000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://crl.dhimyotis.com/certignarootca.crlEcDeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://google.com/DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://google.com/mail/DeltaX.exe, 00000001.00000003.1757831705.000001A78F629000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://google.com/mail/DeltaX.exe, 00000001.00000003.1761417012.000001A78FB32000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755530803.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764904259.000001A78FB33000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756836999.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758818088.000001A78FB20000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FB20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/urllib3/urllib3/issues/32902DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://crl.securetrust.com/STCA.crlDeltaX.exe, 00000001.00000003.1755530803.000001A78FA82000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755928909.000001A78FA86000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1764740250.000001A78FA8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754836900.000001A78FA3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://wwwsearch.sf.net/):DeltaX.exe, 00000001.00000003.1757728184.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758786155.000001A78FBD4000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759429791.000001A78FBD6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754518855.000001A78FBCB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/urllib3/urllib3/issues/3290DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://www.accv.es/legislacion_c.htmDeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755372402.000001A78F5E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758700404.000001A78F5FA000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759120907.000001A78F5FD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://tools.ietf.org/html/rfc6125#section-6.4.3DeltaX.exe, 00000001.00000002.1765536273.000001A78FDE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://raw.githubusercontent.com/gabjohn3/nb/main/12kav.jsonDeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://crl.xrampsecurity.com/XGCA.crl0DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757337027.000001A78FF1D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://www.openssl.org/HDeltaX.exe, 00000000.00000003.1700661501.000001A974FA1000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmp, DeltaX.exe, 00000001.00000002.1772648557.00007FFE013E8000.00000002.00000001.01000000.00000013.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://crl.certigna.fr/certignarootca.crl01DeltaX.exe, 00000001.00000003.1757814022.000001A78FF64000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760550087.000001A78FF8C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757405857.000001A78FF5A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF5B000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757859158.000001A78FF85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crldXDeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757391154.000001A78FF48000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF50000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757455382.000001A78FF4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://www.cert.fnmt.es/dpcs/DeltaX.exe, 00000001.00000003.1754788522.000001A78F688000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759212930.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757264882.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758628205.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757540201.000001A78FF74000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755486890.000001A78F68C000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756530762.000001A78F68D000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1766070477.000001A78FF75000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757120471.000001A78FF6D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://google.com/mailDeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756253162.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758716572.000001A78FBB0000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757291539.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1760804885.000001A78D4C7000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1762658774.000001A78D4CC000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755628529.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754698786.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756803320.000001A78FBAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://packaging.python.org/specifications/entry-points/DeltaX.exe, 00000001.00000002.1765471329.000001A78FD60000.00000004.00001000.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765504074.000001A78FDA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://brave.com/api/webhooks/123teDeltaX.exe, 00000001.00000002.1764224078.000001A78F860000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://www.accv.es00DeltaX.exe, 00000001.00000003.1757078401.000001A78FF3F000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757217863.000001A78FF52000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755306092.000001A78F5E2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1756969636.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754237730.000001A78FF1A000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755372402.000001A78F5E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757896569.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000002.1765993745.000001A78FF55000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1758700404.000001A78F5FA000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759120907.000001A78F5FD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyDeltaX.exe, 00000001.00000003.1756187553.000001A78F5E3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://github.com/urllibyDeltaX.exe, 00000001.00000003.1755871525.000001A78F607000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755158982.000001A78F607000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1757831705.000001A78F629000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://brave.com/api/webhooks/1230)QDeltaX.exe, 00000001.00000002.1766976010.000001A7904F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://foss.heptapod.net/pypy/pypy/-/issues/3539DeltaX.exe, 00000001.00000002.1764370950.000001A78F940000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.DeltaX.exe, 00000001.00000003.1755228217.000001A78D4C3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1754989910.000001A78D434000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759598297.000001A78D4E6000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755328581.000001A78D4D2000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1759446724.000001A78D4E3000.00000004.00000020.00020000.00000000.sdmp, DeltaX.exe, 00000001.00000003.1755907138.000001A78D4D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/psf/requests/pull/6710DeltaX.exe, 00000001.00000002.1766602794.000001A790350000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high

                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                  Public IPs

                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                  54.230.112.122
                                                                                                                                                                                  		brave.comUnited States
                                                                                                                                                                                  		16509AMAZON-02USfalse

                                                                                                                                                                                  General Information

                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                  Analysis ID:1578142
                                                                                                                                                                                  Start date and time:2024-12-19 10:24:09 +01:00
                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                  Overall analysis duration:0h 6m 9s
                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                  Report type:full
                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                  Number of analysed new started processes analysed:2
                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                  Technologies:
                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                  Sample name:DeltaX.exe
                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                  Classification:mal56.winEXE@3/34@1/1
                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                  • Successful, ratio: 76%
                                                                                                                                                                                  • Number of executed functions: 54
                                                                                                                                                                                  • Number of non-executed functions: 202
                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                                                                                  • Stop behavior analysis, all processes terminated

                                                                                                                                                                                  Simulations

                                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                                  ⊘No simulations

                                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                                  IPs

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  54.230.112.122http://propdfhub.comGet hashmaliciousUnknownBrowse

                                                                                                                                                                                    Domains

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    brave.comzapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 18.66.161.26
                                                                                                                                                                                    https://t.co/dTm4CudfP0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 18.173.233.74
                                                                                                                                                                                    https://t.co/dTm4CudfP0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 18.173.233.30

                                                                                                                                                                                    ASNs

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    AMAZON-02USCROC000400 .pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 108.158.75.106
                                                                                                                                                                                    arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                    • 35.167.216.68
                                                                                                                                                                                    x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                    • 35.156.171.87
                                                                                                                                                                                    arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                    • 3.163.158.110
                                                                                                                                                                                    x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                    • 3.248.220.130
                                                                                                                                                                                    https://ipfs.io/ipfs/bafybeih7f27bkklyai5zhnf5s57wuee5khsdrrblepmiz5bozrxxoam2lq/index12.html#pdeneve@vanas.euGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 13.227.8.47
                                                                                                                                                                                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                    • 13.232.112.86
                                                                                                                                                                                    pM3fQBuTLy.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                    • 108.139.47.108
                                                                                                                                                                                    Aqua.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 54.171.230.55
                                                                                                                                                                                    Rapporteer inbreuk op auteursrechten.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 3.125.102.39

                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dllzapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      uFVgJVXaEU.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                        m5804Te9Uw.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                          zapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            3Qv3xyyL5G.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                              K6qneGSDSB.exeGet hashmaliciousBabadeda, RedLineBrowse
                                                                                                                                                                                                oKfMLwqaRZ.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  mggoBrtk9t.exeGet hashmaliciousAmadey, RedLineBrowse
                                                                                                                                                                                                    yINR7uQlPr.exeGet hashmaliciousAmadey, RedLineBrowse
                                                                                                                                                                                                      file.exeGet hashmaliciousRedLineBrowse

                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):89752
                                                                                                                                                                                                        Entropy (8bit):6.5021374229557996
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
                                                                                                                                                                                                        MD5:0E675D4A7A5B7CCD69013386793F68EB
                                                                                                                                                                                                        SHA1:6E5821DDD8FEA6681BDA4448816F39984A33596B
                                                                                                                                                                                                        SHA-256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
                                                                                                                                                                                                        SHA-512:CAE69A90F92936FEBDE67DACD6CE77647CB3B3ED82BB66463CD9047E90723F633AA2FC365489DE09FECDC510BE15808C183B12E6236B0893AF19633F6A670E66
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                        • Filename: zapret.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: uFVgJVXaEU.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: m5804Te9Uw.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: zapret.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: 3Qv3xyyL5G.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: K6qneGSDSB.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: oKfMLwqaRZ.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: mggoBrtk9t.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: yINR7uQlPr.exe, Detection: malicious, Browse
                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x.D.x.D.x.D..AD.x.D..=D.x.D.x.D.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx.QD.x.Dx..E.x.DRich.x.D........PE..d....}.Y.........." .........T...............................................`.......Y....`A........................................p...4............@.......0..(.... ...>...P..p.......8...........................@................................................text...$........................... ..`.rdata...6.......8..................@..@.data...0.... ......................@....pdata..(....0......................@..@.rsrc........@......................@..@.reloc..p....P......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140_1.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):49744
                                                                                                                                                                                                        Entropy (8bit):6.702924040492291
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:qzzO6ujT3MbR3v0Cz6SKLq83yN+iRxw9zv6JmEpw9zF:3q/o1j3c+iIzv6JmEp4zF
                                                                                                                                                                                                        MD5:05052BE2C36166FF9646D7D00BB7413F
                                                                                                                                                                                                        SHA1:D8D7C4B322D76E3A7B591024C62F15934979FE40
                                                                                                                                                                                                        SHA-256:26E470B29BED3D873E0C328186E53F95E9EDBFE0B0FD0CDA44743A0B1A04A828
                                                                                                                                                                                                        SHA-512:0460CC66D06DF9A2941607473F3ECCFD909F2ADAB53A3328FADCEDD1B194B388ECA738C2C6C2E193DE33606925FBED1FE39EFA160015128E93F5E3A03C62170D
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\..\..\...]..\...]..\..O\..\..\...\...]..\...]..\...]..\...]..\..#\..\...]..\Rich..\........PE..d...=............." ...*.<...8.......@..............................................U0....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):84040
                                                                                                                                                                                                        Entropy (8bit):6.41469022264903
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:SSpo7/9ZwseNsUQJ8rbXis0WwOpcAE+8aoBnuRtApxbBVZIG4VJyI:SSW7lZws+bLwOpvEZa+uRWVVZIG4VF
                                                                                                                                                                                                        MD5:3DC8AF67E6EE06AF9EEC52FE985A7633
                                                                                                                                                                                                        SHA1:1451B8C598348A0C0E50AFC0EC91513C46FE3AF6
                                                                                                                                                                                                        SHA-256:C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
                                                                                                                                                                                                        SHA-512:DA16BFBC66C8ABC078278D4D3CE1595A54C9EF43AE8837CEB35AE2F4757B930FE55E258827036EBA8218315C10AF5928E30CB22C60FF69159C8FE76327280087
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.1.).b.).b.).b.Qib.).b.A.c.).bM.=b.).b.A.c.).b.A.c.).b.A.c.).bD@.c.).b.O.c.).b.).b.).bD@.c.).bD@.c.).bD@.b.).bD@.c.).bRich.).b................PE..d.....].........." .........f......t........................................p.......a....`.............................................H............P.......@..(.......H....`......p...T...............................................8............................text...>........................... ..`.rdata..~A.......B..................@..@.data........0......................@....pdata..(....@......................@..@.rsrc........P....... ..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_ctypes.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):123464
                                                                                                                                                                                                        Entropy (8bit):5.886703955852103
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:qpG85kJGmH3c+5M333KvUPzeENGLf3Tz4ccUZw1IGVPE:qDSGT+5+KMPzyLf3TEcKu
                                                                                                                                                                                                        MD5:F1E33A8F6F91C2ED93DC5049DD50D7B8
                                                                                                                                                                                                        SHA1:23C583DC98AA3F6B8B108DB5D90E65D3DD72E9B4
                                                                                                                                                                                                        SHA-256:9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
                                                                                                                                                                                                        SHA-512:229896DA389D78CBDF2168753ED7FCC72D8E0E62C6607A3766D6D47842C0ABD519AC4F5D46607B15E7BA785280F9D27B482954E931645337A152B8A54467C6A5
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..4..4..4..L@..4..\..4..\..4..\..4..\..4..]..4..R..4..R..4..]..4..4.i4..]..4..]..4..],..4..]..4.Rich.4.........PE..d.....].........." .................]....................................................`..........................................`......$a..........................H...........0...T...............................................`............................text............................... ..`.rdata..0l.......n..................@..@.data....>.......:...l..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_elementtree.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):176712
                                                                                                                                                                                                        Entropy (8bit):6.328697645521823
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:6ELu4rq1inmE50HKwCty09ZVz1pGFEH0HCo65Obfh69K+2WhJKP6mrxhM2buspI6:Vu/iCqdty09ZLpGmH4CSr0c+2WhJKP6+
                                                                                                                                                                                                        MD5:5240ABC89BB0822B4F1D830883A17578
                                                                                                                                                                                                        SHA1:1B4412454E35AC9AF9E1E13CF3A441F35E5C7A69
                                                                                                                                                                                                        SHA-256:DEC95E6D7AC0F15DAAC635F1ADDA13B4289BBE7175BA0B14494DC983601F0590
                                                                                                                                                                                                        SHA-512:215B1E807253826C17E9744F46D539C6ED0E0A5FA12FFA654603CEEB6252C64CEA6C931404203364575DE709FD2D964D0EE719F1CC881BD98C5B495885E63D29
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.IA.z.A.z.A.z.Hm..M.z..}{.C.z..}..J.z..}~.I.z..}y.C.z..|{.C.z.$s{.B.z.A.{...z..|w.E.z..|z.@.z..|..@.z..|x.@.z.RichA.z.................PE..d.....].........." ................X~..............................................1.....`.........................................0V..X....V..................0.......H.......X...`...T...............................................8............................text...C........................... ..`.rdata...z.......|..................@..@.data........p.......^..............@....pdata..0............p..............@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):45640
                                                                                                                                                                                                        Entropy (8bit):5.996546047346997
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:8skeCps0iszzPFrGE/CBAdIPGV03ju774xxIGsIx7WDG4yw:81eCpLzDBZ+AdIPmYju7OxIGsIxWyw
                                                                                                                                                                                                        MD5:A6448BC5E5DA21A222DE164823ADD45C
                                                                                                                                                                                                        SHA1:6C26EB949D7EB97D19E42559B2E3713D7629F2F9
                                                                                                                                                                                                        SHA-256:3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
                                                                                                                                                                                                        SHA-512:A3833C7E1CF0E4D181AC4DE95C5DFA685CF528DC39010BF0AC82864953106213ECCFF70785021CCB05395B5CF0DCB89404394327CD7E69F820D14DFA6FBA8CBA
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..&v.uv.uv.u...ur.u$..tt.u$..t}.u$..t~.u$..tt.u...tt.u.ts.uv.u..u.tw.u.tw.u.iuw.u.tw.uRichv.u................PE..d.....].........." .....@...Z......X2...............................................7....`..........................................u..P...@v..........................H............X..T...........................`X...............P...............................text....?.......@.................. ..`.rdata..p3...P...4...D..............@..@.data...h............x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):252488
                                                                                                                                                                                                        Entropy (8bit):6.080982550390949
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:bkHDwqjhhwYbOqQNEkT/4OQhJwAbHoqLNvka/gOFhUw6b4qCNxkV/3OdhAWwPbGE:bd7/IbtSKOt
                                                                                                                                                                                                        MD5:37057C92F50391D0751F2C1D7AD25B02
                                                                                                                                                                                                        SHA1:A43C6835B11621663FA251DA421BE58D143D2AFB
                                                                                                                                                                                                        SHA-256:9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
                                                                                                                                                                                                        SHA-512:953DC856AD00C3AEC6AEAB3AFA2DEB24211B5B791C184598A2573B444761DB2D4D770B8B807EBBA00EE18725FF83157EC5FA2E3591A7756EB718EBA282491C7C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0d..^7..^7..^7..7..^7.._6..^7..[6..^7..Z6..^7..]6..^7Q._6..^7.._6..^7.._7..^7Q.S6..^7Q.^6..^7Q..7..^7Q.\6..^7Rich..^7........PE..d.....].........." .................6..............................................o*....`............................................L.......x.......................H.......$...@...T............................................... ............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_queue.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):28232
                                                                                                                                                                                                        Entropy (8bit):6.051366978773049
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:bp/aC60HGTPk/ltSA/6rCbCnA/cEXEz65D1IGqUrnYPLxDG4y8xxzzI:bH60HGw/b/6rCb9iKD1IGqUrWDG4yCI
                                                                                                                                                                                                        MD5:44B72E0AD8D1E1EC3D8722088B48C3C5
                                                                                                                                                                                                        SHA1:E0F41BF85978DD8F5ABB0112C26322B72C0D7770
                                                                                                                                                                                                        SHA-256:4AA1BBDE1621C49EDAB4376CF9A13C1AA00A9B0A9905D9640A2694EF92F77D5E
                                                                                                                                                                                                        SHA-512:05853F93C6D79D8F9C96519CE4C195B9204DF1255B01329DEAA65E29BD3E988D41454CD305E2199404F587E855737879C330638F2F07BFF11388A49E67BA896C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........k...k...k.......k......k......k......k......k..u....k......k...k..k..u....k..u....k..u.r..k..u....k..Rich.k..................PE..d.....].........." .........8............................................................`..........................................B..L...\B..d....p.......`.......T..H.......l... 3..T............................3...............0..(............................text............................... ..`.rdata.......0......."..............@..@.data........P.......>..............@....pdata.......`.......B..............@..@.rsrc........p.......F..............@..@.reloc..l............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):78920
                                                                                                                                                                                                        Entropy (8bit):6.061178831576516
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:KzMe79sDb+eGm08Vr5lcDAB9/s+7+pkaOz3CkNA9y1IGVwCyMPbi:de79u8/GFmAB9/se+pROz3jN1IGVw+Pm
                                                                                                                                                                                                        MD5:D6BAE4B430F349AB42553DC738699F0E
                                                                                                                                                                                                        SHA1:7E5EFC958E189C117ECCEF39EC16EBF00E7645A9
                                                                                                                                                                                                        SHA-256:587C4F3092B5F3E34F6B1E927ECC7127B3FE2F7FA84E8A3D0C41828583BD5CEF
                                                                                                                                                                                                        SHA-512:A8F8FED5EA88E8177E291B708E44B763D105907E9F8C9E046C4EEBB8684A1778383D1FBA6A5FA863CA37C42FD58ED977E9BB3A6B12C5B8D9AB6EF44DE75E3D1E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._....._...^.._...Z..._...[..._...\.._.a.^.._...^.._...^.B._.a.R..._.a._..._.a..._.a.]..._.Rich.._.................PE..d.....].........." .....x..........h........................................`.......2....`.............................................P...0........@.......0..........H....P.........T...........................@................................................text....v.......x.................. ..`.rdata...v.......x...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_ssl.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):117832
                                                                                                                                                                                                        Entropy (8bit):6.052642675957794
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:x3xozhUCVgMUGSo5iY0nx2bsxSV3QilzQmxLZIG47HZ:p6zh72PGz0nxrmVG
                                                                                                                                                                                                        MD5:8EE827F2FE931163F078ACDC97107B64
                                                                                                                                                                                                        SHA1:149BB536F3492BC59BD7071A3DA7D1F974860641
                                                                                                                                                                                                        SHA-256:EAEEFA6722C45E486F48A67BA18B4ABB3FF0C29E5B30C23445C29A4D0B1CD3E4
                                                                                                                                                                                                        SHA-512:A6D24E72BF620EF695F08F5FFDE70EF93F42A3FA60F7C76EB0F521393C595717E05CCB7A61AE216C18FE41E95FB238D82637714CF5208EE8F1DD32AE405B5565
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0.u.0.u.0.u.9...6.u.b.t.2.u.b.p.<.u.b.q.8.u.b.v.2.u..t.6.u.U.t.7.u.0.t.C.u..x.2.u..u.1.u...1.u..w.1.u.Rich0.u.........PE..d.....].........." ................................................................K.....`..........................................S..d...4T..........................H...........`...T............................................................................text...Q........................... ..`.rdata.............................@..@.data...P4...........h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\_win32sysloader.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                        Entropy (8bit):5.115421390329823
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:xOCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPXRD0QpHvcqvn7ycIt/z/:xOardA0Bzx14r6nDZJhv+L/
                                                                                                                                                                                                        MD5:DC2B691495107A597281EECF8FE49258
                                                                                                                                                                                                        SHA1:B07F274B0C8120C8F9DEFC9C9E98CEEF02818FF1
                                                                                                                                                                                                        SHA-256:B155B2F3310E35F2AE40C89726453CBDBA48632A854192D78A9A7B634C310255
                                                                                                                                                                                                        SHA-512:1D12902BDA5645A92D2FABB93365E1A76FB1C30EF5865B17FD7A54A90FAAB61F4B238AF471C30A20080C8DDF06BEC983010FD9E10EFAE0C85BCB5B4A0ABECDF9
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f...............................................................................................Rich............................PE..d...L..g.........." ......................................................................`..........................................;..`...p;..d....p..l....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...l....p.......4..............@..@.reloc..@............8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1028082
                                                                                                                                                                                                        Entropy (8bit):5.501427098501224
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:24576:fhidpNtosQNRs54PK4IMoVw59bfCEzXxTLEo0zR32w:fhidpNtosQNRs54PK4IM9pTLp0hH
                                                                                                                                                                                                        MD5:E16F9002B63FE3700891D9C164F971F0
                                                                                                                                                                                                        SHA1:FB683ACE0A9E17ED8A4C75B9FF21D98A9931DFA1
                                                                                                                                                                                                        SHA-256:258EFFCB73CFEB1DD3764DA30B0A3D2D15102720FF45FD653025143A746F63AA
                                                                                                                                                                                                        SHA-512:630418BA29A61C366A02E9DF835671CCCC933D83D760A745B54D6F1CFF187DFF600E1BF6AB3EC84D08F179582F68218153653A0338EF6F03E0FF6C92C783F100
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.|...|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...|.r.t...t.j.j.r.d.S.t...t.j...}.|.s2t.j.d.k.r2d.}.|.S.).Nr......darwin....A

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\certifi\cacert.pem

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):299427
                                                                                                                                                                                                        Entropy (8bit):6.047872935262006
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                        MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                        SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                        SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                        SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md.cp38-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                        Entropy (8bit):4.82244276484902
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:96:G03K74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGktCFVCVAZ0fcX6g8H4a81:SFCk2z1/t12iwU5usJFICC4cqgg
                                                                                                                                                                                                        MD5:19286C0938EE5B29D916B4035E539200
                                                                                                                                                                                                        SHA1:FA74A9047A3DFCFE3F4F305B8D61267FB16B0650
                                                                                                                                                                                                        SHA-256:CBCB25410A11775DF37DCF4809B6EC5D6F3AA1E997C8AC8CD3FAA2C155121693
                                                                                                                                                                                                        SHA-512:3B849F2D727FA902E92DBBD8D93254CF3D7E7410269E45334D935C7D3B7FD1480A658066F2550DA26AAC5D978D16E0B12BF39DC4FC7C10E4C3C169BD5963124F
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...B...B...K.X.@...R...@.......@...R...A...R...J...R...I......A...B...d.......C.......C.....4.C.......C...RichB...........PE..d....".g.........." ...).....................................................p............`..........................................'..l...\(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):120832
                                                                                                                                                                                                        Entropy (8bit):5.898330437655099
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:Wd/i8g30pUQTpLwNo80GYVqr5wfgB2e/amZB:WVoMrgoe/PZB
                                                                                                                                                                                                        MD5:D702A14B17BCD02C9AD1CE8137D925AA
                                                                                                                                                                                                        SHA1:7A26ED8CCC3EBA1F97DA7CCADA58B043945B7575
                                                                                                                                                                                                        SHA-256:98C04FDC308F1D6388BB129F0101F88EBB020AEB8116F280129E19CDCB832D8D
                                                                                                                                                                                                        SHA-512:02515C6128B2A7909D0B2E43B0D253E331BDBAEB3DF786C9692612703C7E9FD0F7B6CB8E13954F63A0DF6B671D83DD6C021C7F68C965E336A74BDF7057986E00
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rQy.60..60..60..?H..>0..&...40..}H..40..&...50..&...>0..&...;0...D..50..60...0..~...70..~...70..~...70..~...70..Rich60..........PE..d....".g.........." ...).0...........3....................................... ............`.............................................`.......................@...................@y...............................x..@............@...............................text..../.......0.................. ..`.rdata..0Y...@...Z...4..............@..@.data....=.......0..................@....pdata..@...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-1_1.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):3381792
                                                                                                                                                                                                        Entropy (8bit):6.094908167946797
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:49152:Y4TKuk29SIU6i5fOjPWl+0rOh5PKToEGG9I+q4dNQbZQm9aGupuu9LoeiyPaRb84:YiV+CGQ4dtBMeiJRb8+1CPwDv3uFZjN
                                                                                                                                                                                                        MD5:BF83F8AD60CB9DB462CE62C73208A30D
                                                                                                                                                                                                        SHA1:F1BC7DBC1E5B00426A51878719196D78981674C4
                                                                                                                                                                                                        SHA-256:012866B68F458EC204B9BCE067AF8F4A488860774E7E17973C49E583B52B828D
                                                                                                                                                                                                        SHA-512:AE1BDDA1C174DDF4205AB19A25737FE523DCA6A9A339030CD8A95674C243D0011121067C007BE56DEF4EAEFFC40CBDADFDCBD1E61DF3404D6A3921D196DCD81E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...K...3..[...3..[...3..[...3..[...3..U...3...3..{3..qZ...3..qZ..1..qZ...3..qZf..3..qZ...3..Rich.3..................PE..d....k.].........." ......$..........r....................................... 4.......4...`..............................................f...Z3.@.....3.|.....1.......3. .....3..O..P-,.8............................-,..............P3..............................text...g.$.......$................. ..`.rdata.......0$.......$.............@..@.data...Ax....1..*....0.............@....pdata........1.......1.............@..@.idata...#...P3..$....2.............@..@.00cfg........3.......2.............@..@.rsrc...|.....3.......2.............@..@.reloc...x....3..z....3.............@..B........................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\libffi-7.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):32792
                                                                                                                                                                                                        Entropy (8bit):6.372276555451265
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:JYnlpDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYPoBhT/A4:JYe0Vn5Q28J8qsqMttktuTSTWDG4yhRe
                                                                                                                                                                                                        MD5:4424BAF6ED5340DF85482FA82B857B03
                                                                                                                                                                                                        SHA1:181B641BF21C810A486F855864CD4B8967C24C44
                                                                                                                                                                                                        SHA-256:8C1F7F64579D01FEDFDE07E0906B1F8E607C34D5E6424C87ABE431A2322EBA79
                                                                                                                                                                                                        SHA-512:8ADB94893ADA555DE2E82F006AB4D571FAD8A1B16AC19CA4D2EFC1065677F25D2DE5C981473FABD0398F6328C1BE1EBD4D36668EA67F8A5D25060F1980EE7E33
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3..{]A.{]A.{]A...A.{]A..\@.{]A..\@.{]A.{\A.{]A..X@.{]A..Y@.{]A..^@.{]A..Y@.{]A..^@.{]A..]@.{]A.._@.{]ARich.{]A........................PE..d.....\.........." .....F...$.......I...................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\libssl-1_1.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):686112
                                                                                                                                                                                                        Entropy (8bit):5.528877787845415
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:3L6MSpHovlo4qL7a3ZV9CblMOoAXToRtrBZf3Fb85BO9K9pB3TLPDdOU2lvz8:wIAL7a3heSFZf2Pq63HJOU2lvz
                                                                                                                                                                                                        MD5:FE1F3632AF98E7B7A2799E3973BA03CF
                                                                                                                                                                                                        SHA1:353C7382E2DE3CCDD2A4911E9E158E7C78648496
                                                                                                                                                                                                        SHA-256:1CE7BA99E817C1C2D71BC88A1BDD6FCAD82AA5C3E519B91EBD56C96F22E3543B
                                                                                                                                                                                                        SHA-512:A0123DFE324D3EBF68A44AFAFCA7C6F33D918716F29B063C72C4A8BD2006B81FAEA6848F4F2423778D57296D7BF4F99A3638FC87B37520F0DCBEEFA3A2343DE0
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8<..YRT.YRT.YRT.!.T.YRT.1SU.YRT.?SU.YRT.1WU.YRT.1VU.YRT.1QU.YRTf0SU.YRT.YST.XRTf0VU.YRTf0RU.YRTf0.T.YRTf0PU.YRTRich.YRT................PE..d....k.].........." ..... ...D.......$...............................................2....`..............................................N...%..........s........K...^.. .......D.......8........................... ................................................text...7........ .................. ..`.rdata...#...0...$...$..............@..@.data...1M...`...D...H..............@....pdata...S.......T..................@..@.idata..rV.......X..................@..@.00cfg.......p.......8..............@..@.rsrc...s............:..............@..@.reloc..!............B..............@..B........................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\mfc140u.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):5653536
                                                                                                                                                                                                        Entropy (8bit):6.729079283804055
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
                                                                                                                                                                                                        MD5:CD1D99DF975EE5395174DF834E82B256
                                                                                                                                                                                                        SHA1:F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
                                                                                                                                                                                                        SHA-256:D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
                                                                                                                                                                                                        SHA-512:397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\psutil\_psutil_windows.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                        Entropy (8bit):5.909456553599775
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                        MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                        SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                        SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                        SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\pyarmor_runtime_000000\pyarmor_runtime.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):630272
                                                                                                                                                                                                        Entropy (8bit):6.201282595671309
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:cs1ibNzQ0d7ctjdcg7fUoPpj50XnEYzk:ratctjdcg7fUoPpj50XnJ
                                                                                                                                                                                                        MD5:AFBFE5728BB94436F36057F201493974
                                                                                                                                                                                                        SHA1:DDC6E2B3AD0CC9DA77BD7DCE6D29CCC78294D63D
                                                                                                                                                                                                        SHA-256:583F588DFB2940C63F75CF4B358B1FAE1B69391BD90A77EF71B59E96E6087042
                                                                                                                                                                                                        SHA-512:57E1FD6192802D02710E473CCFBD88D166785092DBFF3C14FABAEA6646683E1884017B8E551ACE4E2EAA901B8707F9192619E773C181DEC747E96841FE3D254C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".............h..0..........f.....................................z........ .........................................].... ..03...........@...$..........................................@...(...................(+...............................text...............................`.P`.data....F... ...H..................@.`..rdata.......p.......P..............@.`@.pdata...$...@...$..................@.0@.xdata...&...p...(...8..............@.0@.bss.....f............................`..edata..]............`..............@.0@.idata..03... ...4...b..............@.0..CRT....X....`......................@.@..tls.........p......................@.@..reloc..............................@.0B........................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\pyexpat.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):189512
                                                                                                                                                                                                        Entropy (8bit):6.306301919858534
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:X/QzNxXNH/aml0Ocp9V69g7eoipCRF0W4XOoKmpgMBUI3CnOnL5MlTe1NE1IGVhb:XIzrNH/a4+L69g7eoKoYXOPmpgMBewMZ
                                                                                                                                                                                                        MD5:E684792507FAF113474A6D1217AEEAAD
                                                                                                                                                                                                        SHA1:F9486048EC025A9F469F52C1788A74E70975B431
                                                                                                                                                                                                        SHA-256:1035C85C840C1007D5F5BB62CA7358D6C85B5E4BF15155FE0857C6A17453F18A
                                                                                                                                                                                                        SHA-512:1A50BC231963D405F25879EE3560EB90F7B18D51640B9B4D848F18CAA9FEF14907F8935A86F093478BE0EE0E1261E4BCC8C697B486BC0617C5F77370337D48C3
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..#:i.p:i.p:i.p3.Jp0i.ph..q8i.ph..q1i.ph..q2i.ph..q8i.p...q8i.p_..q9i.p:i.pTi.p...q>i.p...q;i.p..&p;i.p...q;i.pRich:i.p........................PE..d.....].........." .................................................................3....`.............................................P...P...........................H............4..T............................4............... ...............................text............................... ..`.rdata..2.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):58952
                                                                                                                                                                                                        Entropy (8bit):5.849953914987793
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:oS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxDD:79xiEAnUvdK1IGV0QyrI
                                                                                                                                                                                                        MD5:7ACEC875D5672E7AA148B8C40DF9AA49
                                                                                                                                                                                                        SHA1:96B8CFABE0CFA3DF32995919AC77CFDEEC26F1F2
                                                                                                                                                                                                        SHA-256:D96858E433F45917499DBF5E052E56F079FF9AE259FD3CAA025C3B1DAF852891
                                                                                                                                                                                                        SHA-512:1208DA62FE82B779EC822AD702F9CA4321B34EE590C28E10EFE9A2DB6D582BFDCAE01AB2431C1A98714EF0C60434D64C58F3DB31BF5886EFBB943ADC70D6E975
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d..d..d.N.l..d.N.d..d.N..d.N.f..d.Rich.d.........PE..d.....].........." .....................................................................`.........................................` ..@...............................H............ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\python38.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4183112
                                                                                                                                                                                                        Entropy (8bit):6.420172758698049
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:49152:wV6CJES/Za2BaobNruDPYRQYK8JCNNtkAz+/Q46VqNo9NYxwCFIInKHJCMjntPNj:MxB/aDUQNtufeNFIKHoMjzkDU
                                                                                                                                                                                                        MD5:D2A8A5E7380D5F4716016777818A32C5
                                                                                                                                                                                                        SHA1:FB12F31D1D0758FE3E056875461186056121ED0C
                                                                                                                                                                                                        SHA-256:59AB345C565304F638EFFA7C0236F26041FD06E35041A75988E13995CD28ACE9
                                                                                                                                                                                                        SHA-512:AD1269D1367F587809E3FBE44AF703C464A88FA3B2AE0BF2AD6544B8ED938E4265AAB7E308D999E6C8297C0C85C608E3160796325286DB3188A3EDF040A02AB7
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................7[.........................................B............c...........Rich............................PE..d.....].........." .........."...............................................B.....f.@...`.........................................@I8.....X.9.|.....B.......?.P.....?.H.....B. t..p. .T............................. .................X............................text...$........................... ..`.rdata..............................@..@.data........09......"9.............@....pdata..P.....?......2=.............@..@.rsrc.........B......8?.............@..@.reloc.. t....B..v...D?.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pythoncom38.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):673280
                                                                                                                                                                                                        Entropy (8bit):6.0419437910215255
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:6144:Ve+P6+MWPDCpiqo/r/wm/tx61waoXe1a84TkOz4ApSVIHs4ppdUKsGZ7QXlf:VelBcDh/wmVw1ayoFPppdUl
                                                                                                                                                                                                        MD5:F0392A9234F19A7312749E32B7C2AABC
                                                                                                                                                                                                        SHA1:3A06EB7FE07F4F72C43D44C84B0E8D0CF45B6B7B
                                                                                                                                                                                                        SHA-256:3890C952D049677351D50B940793E82FB9F065AC77A97CD228C187616BE1687E
                                                                                                                                                                                                        SHA-512:B81E1DE6083123CFEBF360F0FEFD0DC18FC6B361BB2B4A8249D71D77B9BB2E275C854998142A2774200D1864D3CAFC706F5D0CA9238E0EC859B3578922FCB698
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R0.~.Q.-.Q.-.Q.-.).-.Q.-D$.,.Q.-D$.,.Q.-D$.,.Q.-D$.,.Q.-.$.,.Q.-]).,.Q.-.%.,.Q.-]).,.Q.-.Q.-BP.-.$.,GQ.-.$.,.Q.-.$.,.Q.-Rich.Q.-........PE..d...x..g.........." ......................................................................`.........................................@`...c..............\....@...z............... ......T........................... ...8............................................text...3........................... ..`.rdata..T/.......0..................@..@.data....L..........................@....pdata...z...@...|..................@..@.rsrc...\............ ..............@..@.reloc... ......."...$..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\pywin32_system32\pywintypes38.dll

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):136192
                                                                                                                                                                                                        Entropy (8bit):5.993915222442933
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:cXt1g7xR7WsXCBcyohpY/rjYarWSbJm/fEJTdXSwd0Lxwp:cXXg7xNFXC8Y/rxbbJmnEVdXSuQ
                                                                                                                                                                                                        MD5:7F960B22965D51F44D3046F3930D3471
                                                                                                                                                                                                        SHA1:DEFC4A353F6A14E316C1FE4085180CECA9EE6CE0
                                                                                                                                                                                                        SHA-256:D2DF2F815AB392812399143D6CB661C807449FA8409FD126F39F656769B8A728
                                                                                                                                                                                                        SHA-512:FA4484DBFA3E13F0FA1C4F1CF1DA0C3F76DE157586B49165A400EADBF9A7EFFAF318AA33A7A222F927222531107977FB7BE7CD62E4623B31B111E21AC4EDFD0C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........YE+I8+xI8+xI8+x@@.xE8+x.M*yM8+x/W.xH8+x.M.y]8+x.M/yA8+x.M(yJ8+x.@/yH8+x.L*yK8+x.@*yB8+xI8*x.8+x.M"yD8+x.M+yH8+x.M)yH8+xRichI8+x........................PE..d...,..g.........." .........................................................`............`.............................................lB......,....@..d.... ...............P..0....b..T............................c..8............................................text...Y........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...d....@......................@..@.reloc..0....P......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):26696
                                                                                                                                                                                                        Entropy (8bit):6.101296746249305
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:6kYtqIDCNdwhBfAqXuqzz5H1IGqGbWDG4y4:6TnDCNCh93X7zzR1IGqG2y4
                                                                                                                                                                                                        MD5:6AE54D103866AAD6F58E119D27552131
                                                                                                                                                                                                        SHA1:BC53A92A7667FD922CE29E98DFCF5F08F798A3D2
                                                                                                                                                                                                        SHA-256:63B81AF5D3576473C17AC929BEA0ADD5BF8D7EA95C946CAF66CBB9AD3F233A88
                                                                                                                                                                                                        SHA-512:FF23F3196A10892EA22B28AE929330C8B08AB64909937609B7AF7BFB1623CD2F02A041FD9FAB24E4BC1754276BDAFD02D832C2F642C8ECDCB233F639BDF66DD0
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................)............................M................M......M......M.E....M......Rich...........PE..d.....].........." .........2......h...............................................a"....`..........................................?..L....@..x....p.......`.......N..H.......,....2..T............................3...............0...............................text...u........................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc..,............L..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1096264
                                                                                                                                                                                                        Entropy (8bit):5.343512979675051
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:EGe9qQOZ67191SnFRFotduNFBjCmN/XlyCAx9++bBlhJk93cgewrxEeBc0bB:EGe9GK4oYhCc/+9nbDhG2wrxc0bB
                                                                                                                                                                                                        MD5:4C0D43F1A31E76255CB592BB616683E7
                                                                                                                                                                                                        SHA1:0A9F3D77A6E064BAEBACACC780701117F09169AD
                                                                                                                                                                                                        SHA-256:0F84E9F0D0BF44D10527A9816FCAB495E3D797B09E7BBD1E6BD666CEB4B6C1A8
                                                                                                                                                                                                        SHA-512:B8176A180A441FE402E86F055AA5503356E7F49E984D70AB1060DEE4F5F17FCEC9C01F75BBFF75CE5F4EF212677A6525804BE53646CC0D7817B6ED5FD83FD778
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.0v..^%..^%..^%.f.%..^%Tv_$..^%Tv[$..^%TvZ$..^%Tv]$..^%.w_$..^%cx_$..^%.._%N.^%.wS$..^%.w^$..^%.w.%..^%.w\$..^%Rich..^%................PE..d.....].........." .....L...V.......*..............................................-.....`.........................................p...X..............................H........... )..T............................)...............`..p............................text...1J.......L.................. ..`.rdata..>-...`.......P..............@..@.data................~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\win32api.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):133120
                                                                                                                                                                                                        Entropy (8bit):5.86120949149104
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:3wBdzUgdnhvjZXA2SRJzlRVFhLaNzvblJTqQvmP+0NfAdWe:3wsgdRjZXA2+tlRVgvZRqQ10Vy
                                                                                                                                                                                                        MD5:01196228998669ACFD2A4AA7E1E18A26
                                                                                                                                                                                                        SHA1:A7C3C59CB120EF75CA6F9A7A2E035783CD5933BB
                                                                                                                                                                                                        SHA-256:DA256A6EEB9C5512E869CA5452EC373A7C3AA8BE13AFEB76FD650738A5ADFBEC
                                                                                                                                                                                                        SHA-512:A2C627978B33A0FB8DDBEB7FF8C920F7BC357736D5C981A3F003ADF1CD8E6CB51B17FDF5847B98D024C3FF721550A5E8209B735E027110FF75ED56A10498C117
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V@m..@m..@m..I...Hm......Dm......Hm......Dm......Bm......Bm......Wm......Km..@m...l......Bm......Am......Am..Rich@m..................PE..d...O..g.........." ................8........................................P............`................................................d........0..T....................@..X....w..T............................<..8............0......d...@....................text...D........................... ..`.rdata.......0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...T....0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\win32trace.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):23552
                                                                                                                                                                                                        Entropy (8bit):5.281734532194338
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:tYGx6lLxGhN0H2So0JVPls+0T8DqqpqkW87P0bkZ5yn9g1BT:zl0WCaNkW87cSUuB
                                                                                                                                                                                                        MD5:3122A07137DEA2F663F0F5A57C68306A
                                                                                                                                                                                                        SHA1:9EA6A6DC321993F5EB1185F674B515BDF851718D
                                                                                                                                                                                                        SHA-256:B6AE09668425F318E2A56286F635EFC591B92C14870085A485A65A6E40F3A0C0
                                                                                                                                                                                                        SHA-512:98B2D850F79FCD4DF2D57C4692EFB08B550A20DDDB38C4A95CE794B78A1F84FD1AD7EA21A5845C364AC79523F668C4350628FDF7D7DABF4056DD07F25B67C6AE
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r$(U6EF.6EF.6EF.?=..2EF.d0G.4EF.d0C.<EF.d0B.>EF.d0E.5EF..0G.4EF..1G.4EF.}=G.3EF.6EG.{EF..0O.7EF..0F.7EF..0D.7EF.Rich6EF.........PE..d...G..g.........." .....*...........'....................................................`..........................................Q..T....Q..........\....p.......................G..T...........................PH..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...\............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI73442\win32ui.pyd

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1146880
                                                                                                                                                                                                        Entropy (8bit):6.055737484366553
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12288:A8kQJhn+6cxX9KOcol6NRn2Ri0VRxRz5jAs7FYyk2+wwZ8Oq:ANP6c8oiRnP2RFUsRY2+V8
                                                                                                                                                                                                        MD5:0E754914E42F2220C530A0212293BF51
                                                                                                                                                                                                        SHA1:242220538FBE59D141B44895FC8054FDB1A8358D
                                                                                                                                                                                                        SHA-256:CDFAF61B88C03F8C35BC0476A5CB85365B591787EE1B2FFEF264BFC570C9524A
                                                                                                                                                                                                        SHA-512:CDF127981996C2AFA94E09E0D9CEDF5D6F3512EF3F2505C9616EBD21F5B0BA4E5A1E1069AED84D1111A400BBCA8AED904948F91D47B961076A50528DD02A1E7A
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x.K;...;...;...2a].1....l..9....m..9...pa..5...il..3...il..?...il..-...;...3...il..<....l.......l..:....l1.:....l..:...Rich;...................PE..d...E..g.........." .........t.............................................. ............`..........................................1...T......h...............................`\......T.......................(...@...8............ ...0...........................text...0........................... ..`.rdata....... ......................@..@.data...............................@....pdata...............r..............@..@.rsrc...............................@..@.reloc..`\.......^..."..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\kyojenit

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:qn:qn
                                                                                                                                                                                                        MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                        SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                        SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                        SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:blat

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4i57dvwl\gen_py\__init__.py

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):176
                                                                                                                                                                                                        Entropy (8bit):4.713840781302666
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                        MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                        SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                        SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                        SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4i57dvwl\gen_py\dicts.dat

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):10
                                                                                                                                                                                                        Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3:qW6:qW6
                                                                                                                                                                                                        MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                        SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                        SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                        SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:..K....}..

                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        File type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                        Entropy (8bit):7.996282067684745
                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                        • Win64 Executable (generic) (12005/4) 74.95%
                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 12.51%
                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 12.50%
                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
                                                                                                                                                                                                        File name:DeltaX.exe
                                                                                                                                                                                                        File size:10'374'703 bytes
                                                                                                                                                                                                        MD5:8c02c616f0d561e49ae8c000c1c9bc7a
                                                                                                                                                                                                        SHA1:9709433a4028348c3d1bd0f6684d97e5d949e9c0
                                                                                                                                                                                                        SHA256:6dc4e9a65a2aa8622e224c4b1d55b5d1389143a3971a58c2393d20dc29f307b4
                                                                                                                                                                                                        SHA512:5c11b6ce69dded0d7ddcb1d6cbd9b145c1e6a88910059bf9ed55fa11f41971aafc1aae929215ef84d25c474bb40d91559cc7f7b3a3131c333babab5f55809309
                                                                                                                                                                                                        SSDEEP:196608:uIguWJysVYvsOtV1Z2azjvj8p5drY+0sroyMxxvjDDAxB9GQHSv0rEU4+W:HWJeVlj87dqQoyMxtDDAxpHBrF4X
                                                                                                                                                                                                        TLSH:ABA63373C6A2584AE5B90030D4B4A0B11A62F9690F109C2BCAB55F797F57FB47F788D0
                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....bg.@.............(.x...2.................@.....................................X....`................................

                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                        Icon Hash:4a464cd47461e179

                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Entrypoint:0x1400010f6
                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
                                                                                                                                                                                                        Time Stamp:0x6762E10C [Wed Dec 18 14:49:48 2024 UTC]
                                                                                                                                                                                                        TLS Callbacks:0x4000ccc0, 0x1, 0x4000cd80, 0x1
                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                        Import Hash:2b762c3d5d512cd6bf5a5baf230d4a2e

                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 30h
                                                                                                                                                                                                        mov dword ptr [ebp-04h], 000000FFh
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [0001F854h]
                                                                                                                                                                                                        mov dword ptr [eax], 00000001h
                                                                                                                                                                                                        call 00007EFE4CE1AE42h
                                                                                                                                                                                                        mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        mov eax, dword ptr [ebp-04h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        add esp, 30h
                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                        ret
                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 30h
                                                                                                                                                                                                        mov dword ptr [ebp-04h], 000000FFh
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [0001F825h]
                                                                                                                                                                                                        mov dword ptr [eax], 00000000h
                                                                                                                                                                                                        call 00007EFE4CE1AE13h
                                                                                                                                                                                                        mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        mov eax, dword ptr [ebp-04h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        add esp, 30h
                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                        ret
                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        sub esp, 70h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov dword ptr [ebp-10h], 00000000h
                                                                                                                                                                                                        mov dword ptr [ebp-1Ch], 00000030h
                                                                                                                                                                                                        mov eax, dword ptr [ebp-1Ch]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [eax]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [ebp-28h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [eax+08h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov dword ptr [ebp-18h], eax
                                                                                                                                                                                                        mov dword ptr [ebp-04h], 00000000h
                                                                                                                                                                                                        jmp 00007EFE4CE1AE23h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [ebp-10h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        cmp eax, dword ptr [ebp-18h]
                                                                                                                                                                                                        jne 00007EFE4CE1AE0Bh
                                                                                                                                                                                                        mov dword ptr [ebp-04h], 00000001h
                                                                                                                                                                                                        jmp 00007EFE4CE1AE47h
                                                                                                                                                                                                        mov ecx, 000003E8h
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [00034536h]
                                                                                                                                                                                                        call eax
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [0001F7FDh]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov eax, dword ptr [ebp-18h]
                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                        mov dword ptr [ebp+00h], eax

                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x350000x15f0.idata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x390000xf494.rsrc
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x240000xf18.pdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x490000x154.reloc
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x1fb400x28.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x355800x4f0.idata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                        Sections

                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                        .text0x10000x176980x178003162e04946f8d70363991ef77146f968False0.4406582446808511data6.151760427259421IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .data0x190000x1300x20011b0fb1eb27a7b33f30f63c84010d98bFalse0.189453125data1.3374538668500189IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .rdata0x1a0000x83600x840090488b6a86573a6cc98f474860f95d61False0.4765920928030303data6.541956983892695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        /40x230000x40x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .pdata0x240000xf180x10001d55bf60c7a95ecb39a7a169edbdf562False0.460205078125data4.949066468343522IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .xdata0x250000xf300x1000d536cede0a0b44ac8e685a7f15b04085False0.228515625shared library4.273158269466835IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .bss0x260000xeff00x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .idata0x350000x15f00x1600dac35fc335ee1f745ab20fbc17d1616bFalse0.33061079545454547data4.455839108298774IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .CRT0x370000x600x20032b18f38c3c4ba3205e8c160ed8fa8edFalse0.06640625data0.29046607431271465IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .tls0x380000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .rsrc0x390000xf4940xf6008f1e755314f9e1a2a5c307c4e4ca9fc1False0.8035600863821138data7.555503971609621IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .reloc0x490000x1540x2003b590444fe5db0d8f4418a97264a915bFalse0.529296875data3.743194766435929IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                        Resources

                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                        RT_ICON0x392080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                        RT_ICON0x3a0b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                        RT_ICON0x3a9580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                        RT_ICON0x3aec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                        RT_ICON0x443ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                        RT_ICON0x469940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                        RT_ICON0x47a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                        RT_GROUP_ICON0x47ea40x68data0.7019230769230769
                                                                                                                                                                                                        RT_MANIFEST0x47f0c0x586XML 1.0 document, ASCII text, with CRLF line terminators0.44554455445544555

                                                                                                                                                                                                        Imports

                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                        ADVAPI32.dllConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
                                                                                                                                                                                                        COMCTL32.dllLoadIconMetric
                                                                                                                                                                                                        GDI32.dllCreateFontIndirectW, DeleteObject, SelectObject
                                                                                                                                                                                                        KERNEL32.dllCloseHandle, CreateDirectoryW, CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, __C_specific_handler
                                                                                                                                                                                                        msvcrt.dll___lc_codepage_func, ___mb_cur_max_func, __argc, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _filelengthi64, _fileno, _findclose, _fileno, _fmode, _get_osfhandle, _getpid, _initterm, _lock, _onexit, _setmode, _snwprintf, _stat64, _strdup, _unlock, _wcmdln, _wcsdup, _wcsdup, _wfindfirst64, _wfindnext64, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wstat64, _wtempnam, abort, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwprintf, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setbuf, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs
                                                                                                                                                                                                        USER32.dllCreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongPtrW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongPtrW, SystemParametersInfoW

                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.717865944 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.717900038 CET4434973154.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.718113899 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.718894958 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.718909025 CET4434973154.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.178237915 CET4434973154.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.179054022 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.179089069 CET4434973154.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.181195021 CET4434973154.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.181278944 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.181885004 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.182019949 CET49731443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.187243938 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.187289000 CET4434973254.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.187386990 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.187731028 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:08.187748909 CET4434973254.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.591972113 CET4434973254.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.592312098 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.592333078 CET4434973254.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.593808889 CET4434973254.230.112.122192.168.2.4
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.593878984 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.594399929 CET49732443192.168.2.454.230.112.122
                                                                                                                                                                                                        Dec 19, 2024 10:25:09.594527006 CET49732443192.168.2.454.230.112.122

                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.575746059 CET5096553192.168.2.41.1.1.1
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.713546991 CET53509651.1.1.1192.168.2.4

                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.575746059 CET192.168.2.41.1.1.10xffa0Standard query (0)brave.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.713546991 CET1.1.1.1192.168.2.40xffa0No error (0)brave.com54.230.112.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.713546991 CET1.1.1.1192.168.2.40xffa0No error (0)brave.com54.230.112.35A (IP address)IN (0x0001)false
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.713546991 CET1.1.1.1192.168.2.40xffa0No error (0)brave.com54.230.112.55A (IP address)IN (0x0001)false
                                                                                                                                                                                                        Dec 19, 2024 10:25:06.713546991 CET1.1.1.1192.168.2.40xffa0No error (0)brave.com54.230.112.8A (IP address)IN (0x0001)false

                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                        Start time:04:25:02
                                                                                                                                                                                                        Start date:19/12/2024
                                                                                                                                                                                                        Path:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\DeltaX.exe"
                                                                                                                                                                                                        Imagebase:0x7ff654ca0000
                                                                                                                                                                                                        File size:10'374'703 bytes
                                                                                                                                                                                                        MD5 hash:8C02C616F0D561E49AE8C000C1C9BC7A
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                        Start time:04:25:04
                                                                                                                                                                                                        Start date:19/12/2024
                                                                                                                                                                                                        Path:C:\Users\user\Desktop\DeltaX.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\DeltaX.exe"
                                                                                                                                                                                                        Imagebase:0x7ff654ca0000
                                                                                                                                                                                                        File size:10'374'703 bytes
                                                                                                                                                                                                        MD5 hash:8C02C616F0D561E49AE8C000C1C9BC7A
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                          Execution Coverage:6.4%
                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                          Signature Coverage:17.7%
                                                                                                                                                                                                          Total number of Nodes:1140
                                                                                                                                                                                                          Total number of Limit Nodes:20
                                                                                                                                                                                                          execution_graph 9067 7ff654ca10f6 9070 7ff654ca1154 9067->9070 9071 7ff654ca118b 9070->9071 9072 7ff654ca11f1 _amsg_exit 9071->9072 9073 7ff654ca11fd 9071->9073 9074 7ff654ca1232 9072->9074 9073->9074 9075 7ff654ca120a _initterm 9073->9075 9076 7ff654ca124a _initterm 9074->9076 9077 7ff654ca1270 9074->9077 9075->9074 9076->9077 9086 7ff654ca147c 9077->9086 9079 7ff654ca1309 9091 7ff654cacba0 9079->9091 9082 7ff654ca1350 exit 9083 7ff654ca135d 9082->9083 9084 7ff654ca1367 _cexit 9083->9084 9085 7ff654ca1117 9083->9085 9084->9085 9087 7ff654ca14a2 9086->9087 9088 7ff654ca1558 9087->9088 9089 7ff654ca14bd 9087->9089 9088->9079 9090 7ff654ca14dc malloc memcpy 9089->9090 9090->9087 9094 7ff654cacbc6 9091->9094 9092 7ff654cacc48 memset 9093 7ff654cacc6f 9092->9093 9097 7ff654ca16d0 9093->9097 9094->9092 9168 7ff654ca8160 9097->9168 9099 7ff654ca16f3 9175 7ff654ca21b0 calloc 9099->9175 9104 7ff654ca6310 FreeLibrary 9107 7ff654ca3f26 9104->9107 9105 7ff654ca3b9a 9105->9107 9189 7ff654ca6fe0 9105->9189 9107->9104 9108 7ff654ca61b0 4 API calls 9107->9108 9112 7ff654ca3fea fclose 9107->9112 9126 7ff654ca2cd0 10 API calls 9107->9126 9136 7ff654ca3c4e 9107->9136 9336 7ff654ca5ee0 9107->9336 9364 7ff654ca6100 9107->9364 9467 7ff654ca6430 9107->9467 9108->9107 9111 7ff654ca3be7 9114 7ff654ca3d50 9111->9114 9115 7ff654ca3bf3 9111->9115 9112->9107 9113 7ff654ca20b0 41 API calls 9113->9136 9196 7ff654ca70d0 9114->9196 9117 7ff654ca6fe0 15 API calls 9115->9117 9119 7ff654ca3bff 9117->9119 9118 7ff654ca3d58 9199 7ff654ca20b0 9118->9199 9122 7ff654ca3c38 9119->9122 9123 7ff654ca3c1b free 9119->9123 9129 7ff654ca3f00 9119->9129 9125 7ff654ca70d0 12 API calls 9122->9125 9127 7ff654ca70d0 12 API calls 9123->9127 9130 7ff654ca3c40 9125->9130 9126->9107 9127->9122 9128 7ff654ca3d6e 9133 7ff654ca3520 10 API calls 9128->9133 9132 7ff654ca20b0 41 API calls 9129->9132 9134 7ff654ca20b0 41 API calls 9130->9134 9131 7ff654ca3c90 SetDllDirectoryW 9135 7ff654ca6170 12 API calls 9131->9135 9147 7ff654ca3d84 9132->9147 9133->9147 9134->9136 9135->9136 9136->9107 9136->9113 9136->9131 9141 7ff654ca61b0 4 API calls 9136->9141 9142 7ff654ca3cb9 strcmp 9136->9142 9148 7ff654ca3cf1 strcpy 9136->9148 9158 7ff654ca3eb2 9136->9158 9233 7ff654ca5cc0 9136->9233 9250 7ff654ca61b0 9136->9250 9259 7ff654ca3580 9136->9259 9267 7ff654ca7070 9136->9267 9305 7ff654ca8210 9136->9305 9318 7ff654ca3b20 9136->9318 9137 7ff654ca3e3e 9229 7ff654ca6170 calloc 9137->9229 9141->9142 9142->9136 9143 7ff654ca3d0a 9142->9143 9321 7ff654ca3aa0 9143->9321 9147->9107 9147->9112 9147->9137 9210 7ff654ca43b0 9147->9210 9216 7ff654ca7d30 malloc 9147->9216 9225 7ff654ca3520 9147->9225 9148->9143 9151 7ff654ca3d1a 9153 7ff654ca6310 FreeLibrary 9151->9153 9155 7ff654ca3d2e 9153->9155 9156 7ff654ca61b0 4 API calls 9155->9156 9157 7ff654ca1340 9156->9157 9157->9082 9157->9083 9272 7ff654ca79c0 9158->9272 9160 7ff654ca3ec8 9283 7ff654ca6310 9160->9283 9163 7ff654ca61b0 4 API calls 9164 7ff654ca3ede 9163->9164 9165 7ff654ca3eeb 9164->9165 9289 7ff654ca7490 9164->9289 9330 7ff654ca21f0 9165->9330 9170 7ff654ca817e 9168->9170 9169 7ff654ca81d9 9169->9099 9170->9169 9172 7ff654ca81b1 9170->9172 9473 7ff654ca8040 9170->9473 9173 7ff654ca81c0 free 9172->9173 9173->9173 9174 7ff654ca81d1 free 9173->9174 9174->9169 9176 7ff654ca21c8 9175->9176 9177 7ff654ca21cd 9175->9177 9176->9107 9179 7ff654ca42f0 9176->9179 9527 7ff654ca2e50 9177->9527 9535 7ff654cae230 9179->9535 9181 7ff654ca42fc GetModuleFileNameW 9182 7ff654ca4348 9181->9182 9183 7ff654ca431c 9181->9183 9185 7ff654ca2db0 10 API calls 9182->9185 9184 7ff654ca8040 13 API calls 9183->9184 9186 7ff654ca432d 9184->9186 9187 7ff654ca433a 9185->9187 9186->9187 9537 7ff654ca2cd0 9186->9537 9187->9105 9190 7ff654ca6feb 9189->9190 9191 7ff654ca8210 10 API calls 9190->9191 9192 7ff654ca7000 GetEnvironmentVariableW 9191->9192 9193 7ff654ca7028 ExpandEnvironmentStringsW 9192->9193 9195 7ff654ca7016 9192->9195 9194 7ff654ca8040 13 API calls 9193->9194 9194->9195 9195->9111 9197 7ff654ca8210 10 API calls 9196->9197 9198 7ff654ca70e3 SetEnvironmentVariableW free 9197->9198 9198->9118 9542 7ff654ca1a80 9199->9542 9202 7ff654ca20df 9202->9128 9202->9129 9203 7ff654ca1a80 fputc 9204 7ff654ca210b 9203->9204 9204->9202 9545 7ff654ca4040 9204->9545 9209 7ff654ca2158 fclose 9209->9202 9211 7ff654ca43bd 9210->9211 9212 7ff654ca8210 10 API calls 9211->9212 9213 7ff654ca43de 9212->9213 9214 7ff654ca8210 10 API calls 9213->9214 9215 7ff654ca43ef _wfopen 9214->9215 9215->9147 9217 7ff654ca7d5f 9216->9217 9224 7ff654ca7e19 free 9216->9224 9218 7ff654caf2c0 2 API calls 9217->9218 9220 7ff654ca7d6f 9218->9220 9220->9224 9615 7ff654caf3b0 9220->9615 9222 7ff654ca7d7f 9223 7ff654caf2c0 2 API calls 9222->9223 9222->9224 9223->9222 9224->9147 9226 7ff654ca3540 9225->9226 9228 7ff654ca353a 9225->9228 9226->9228 9620 7ff654ca1ab0 9226->9620 9228->9147 9230 7ff654ca618d 9229->9230 9232 7ff654ca6188 9229->9232 9231 7ff654ca2e50 11 API calls 9230->9231 9231->9232 9232->9136 9234 7ff654ca5e30 9233->9234 9235 7ff654ca5ce5 9233->9235 9236 7ff654ca5e0d 9234->9236 9237 7ff654ca5e57 9234->9237 9241 7ff654ca1ab0 10 API calls 9234->9241 9238 7ff654ca5cf7 strncpy strncpy 9235->9238 9236->9136 9635 7ff654ca1af0 9237->9635 9625 7ff654ca40e0 9238->9625 9241->9234 9242 7ff654ca5e5c 9242->9236 9244 7ff654ca5e6f 9242->9244 9243 7ff654ca5d3a calloc malloc malloc 9243->9244 9245 7ff654ca5dbc 9243->9245 9246 7ff654ca2cd0 10 API calls 9244->9246 9245->9244 9247 7ff654ca5dca memcpy memcpy memcpy 9245->9247 9246->9236 9248 7ff654ca5e20 free 9247->9248 9249 7ff654ca5e0b 9247->9249 9248->9249 9249->9236 9251 7ff654ca61c1 9250->9251 9252 7ff654ca61fc 9250->9252 9253 7ff654ca61d2 9251->9253 9254 7ff654ca61cd free 9251->9254 9252->9136 9255 7ff654ca61de free 9253->9255 9256 7ff654ca61e3 9253->9256 9254->9253 9255->9256 9257 7ff654ca61ef free 9256->9257 9258 7ff654ca61f4 free 9256->9258 9257->9258 9258->9252 9260 7ff654ca3669 9259->9260 9261 7ff654ca35b8 9259->9261 9260->9136 9263 7ff654ca1ab0 10 API calls 9261->9263 9265 7ff654ca360a 9261->9265 9687 7ff654ca1c80 9261->9687 9724 7ff654ca31b0 9261->9724 9263->9261 9265->9260 9266 7ff654ca21f0 2 API calls 9265->9266 9266->9265 9268 7ff654ca8210 10 API calls 9267->9268 9269 7ff654ca7087 9268->9269 9270 7ff654ca8210 10 API calls 9269->9270 9271 7ff654ca7097 _wputenv_s free free 9270->9271 9271->9136 9273 7ff654ca79ce 9272->9273 9274 7ff654ca8210 10 API calls 9273->9274 9275 7ff654ca79fa SetConsoleCtrlHandler GetStartupInfoW 9274->9275 9276 7ff654ca7a69 _fileno _get_osfhandle 9275->9276 9277 7ff654ca7a8b _fileno _get_osfhandle 9276->9277 9278 7ff654ca7aa6 _fileno _get_osfhandle GetCommandLineW CreateProcessW 9277->9278 9279 7ff654ca7b48 9278->9279 9280 7ff654ca7b0c WaitForSingleObject GetExitCodeProcess 9278->9280 9281 7ff654ca2db0 10 API calls 9279->9281 9280->9160 9282 7ff654ca7b5b 9281->9282 9282->9160 9284 7ff654ca6323 9283->9284 9288 7ff654ca3ed4 9283->9288 9285 7ff654ca63ba 9284->9285 9284->9288 9971 7ff654ca7990 FreeLibrary 9284->9971 9285->9288 9972 7ff654ca7990 FreeLibrary 9285->9972 9288->9163 9290 7ff654ca74a6 9289->9290 9291 7ff654ca8210 10 API calls 9290->9291 9292 7ff654ca74d2 9291->9292 9293 7ff654ca74dd wcslen 9292->9293 9294 7ff654ca74f6 9293->9294 9295 7ff654ca74fc wcscat 9293->9295 9294->9295 9296 7ff654ca7550 wcscat 9294->9296 9973 7ff654caee10 9295->9973 9296->9295 9299 7ff654ca7527 _wrmdir 9299->9165 9301 7ff654ca758e 9303 7ff654ca75be _findclose 9301->9303 9304 7ff654ca75d0 25 API calls 9301->9304 9993 7ff654caeef0 9301->9993 9303->9299 9304->9301 9306 7ff654ca8260 MultiByteToWideChar 9305->9306 9307 7ff654ca8223 9305->9307 9309 7ff654ca8295 calloc 9306->9309 9310 7ff654ca82e8 9306->9310 9308 7ff654ca822d MultiByteToWideChar 9307->9308 9311 7ff654ca82c8 9308->9311 9312 7ff654ca824c 9308->9312 9309->9308 9313 7ff654ca82ab 9309->9313 9314 7ff654ca2db0 7 API calls 9310->9314 9316 7ff654ca2db0 7 API calls 9311->9316 9312->9136 9315 7ff654ca2db0 7 API calls 9313->9315 9314->9312 9317 7ff654ca82c0 9315->9317 9316->9312 9317->9312 9319 7ff654caf480 fputc 9318->9319 9320 7ff654ca3b44 9319->9320 9320->9136 10001 7ff654ca51d0 9321->10001 9324 7ff654ca3adb 9324->9151 9331 7ff654ca21fd 9330->9331 9335 7ff654ca2218 9330->9335 9332 7ff654ca2206 free 9331->9332 9333 7ff654ca220b 9331->9333 9332->9333 9334 7ff654ca2213 fclose 9333->9334 9333->9335 9334->9335 9335->9157 9337 7ff654cae230 9336->9337 9338 7ff654ca5ef6 calloc 9337->9338 9339 7ff654ca60d0 strncpy 9338->9339 9343 7ff654ca5f1f 9338->9343 9340 7ff654ca6038 strncpy 9339->9340 9342 7ff654ca40e0 4 API calls 9340->9342 9344 7ff654ca6060 strncpy 9342->9344 9345 7ff654ca5f40 memcpy 9343->9345 9347 7ff654ca5f9d strlen 9343->9347 9348 7ff654ca5fdc 9343->9348 9362 7ff654ca60b0 9343->9362 10290 7ff654ca22e0 9343->10290 9346 7ff654ca40e0 4 API calls 9344->9346 9349 7ff654ca40e0 4 API calls 9345->9349 9350 7ff654ca608d 9346->9350 9347->9343 9354 7ff654ca6010 9347->9354 9351 7ff654ca2cd0 10 API calls 9348->9351 9352 7ff654ca5f64 strlen strlen 9349->9352 10294 7ff654ca40b0 9350->10294 9355 7ff654ca5ff0 free 9351->9355 9357 7ff654ca1c80 88 API calls 9352->9357 9354->9339 9356 7ff654ca6019 9354->9356 9355->9107 9360 7ff654ca40e0 4 API calls 9356->9360 9357->9343 9358 7ff654ca6098 9359 7ff654ca40e0 4 API calls 9358->9359 9361 7ff654ca60a6 9359->9361 9360->9340 9361->9355 9363 7ff654ca2cd0 10 API calls 9362->9363 9363->9361 9365 7ff654ca7950 12 API calls 9364->9365 9366 7ff654ca6111 9365->9366 9367 7ff654ca7950 12 API calls 9366->9367 9368 7ff654ca6124 9367->9368 9369 7ff654ca6150 9368->9369 9370 7ff654ca613f GetProcAddress 9368->9370 9371 7ff654ca2cd0 10 API calls 9369->9371 9374 7ff654ca6b6f 9370->9374 9375 7ff654ca681d GetProcAddress 9370->9375 9372 7ff654ca615c 9371->9372 9372->9107 9376 7ff654ca2db0 10 API calls 9374->9376 9377 7ff654ca6ba4 9375->9377 9378 7ff654ca6839 GetProcAddress 9375->9378 9463 7ff654ca6b65 9376->9463 9381 7ff654ca2db0 10 API calls 9377->9381 9379 7ff654ca6b8f 9378->9379 9380 7ff654ca6855 GetProcAddress 9378->9380 9384 7ff654ca2db0 10 API calls 9379->9384 9382 7ff654ca6bce 9380->9382 9383 7ff654ca6871 GetProcAddress 9380->9383 9381->9463 9385 7ff654ca2db0 10 API calls 9382->9385 9386 7ff654ca6bb9 9383->9386 9387 7ff654ca688d GetProcAddress 9383->9387 9384->9463 9385->9463 9390 7ff654ca2db0 10 API calls 9386->9390 9388 7ff654ca6c10 9387->9388 9389 7ff654ca68a9 GetProcAddress 9387->9389 9393 7ff654ca2db0 10 API calls 9388->9393 9391 7ff654ca68c5 GetProcAddress 9389->9391 9392 7ff654ca6bf8 9389->9392 9390->9463 9395 7ff654ca68e1 GetProcAddress 9391->9395 9396 7ff654ca6be3 9391->9396 9394 7ff654ca2db0 10 API calls 9392->9394 9393->9463 9394->9463 9398 7ff654ca6c28 9395->9398 9399 7ff654ca68fd GetProcAddress 9395->9399 9397 7ff654ca2db0 10 API calls 9396->9397 9397->9463 9402 7ff654ca2db0 10 API calls 9398->9402 9400 7ff654ca6919 GetProcAddress 9399->9400 9401 7ff654ca6c88 9399->9401 9404 7ff654ca6c70 9400->9404 9405 7ff654ca6935 GetProcAddress 9400->9405 9403 7ff654ca2db0 10 API calls 9401->9403 9402->9463 9403->9463 9406 7ff654ca2db0 10 API calls 9404->9406 9407 7ff654ca6951 GetProcAddress 9405->9407 9408 7ff654ca6c58 9405->9408 9406->9463 9410 7ff654ca6c40 9407->9410 9411 7ff654ca696d GetProcAddress 9407->9411 9409 7ff654ca2db0 10 API calls 9408->9409 9409->9463 9412 7ff654ca2db0 10 API calls 9410->9412 9413 7ff654ca6989 GetProcAddress 9411->9413 9414 7ff654ca6ce8 9411->9414 9412->9463 9415 7ff654ca6cd0 9413->9415 9416 7ff654ca69a5 GetProcAddress 9413->9416 9417 7ff654ca2db0 10 API calls 9414->9417 9418 7ff654ca2db0 10 API calls 9415->9418 9419 7ff654ca69c1 GetProcAddress 9416->9419 9420 7ff654ca6cb8 9416->9420 9417->9463 9418->9463 9421 7ff654ca6ca0 9419->9421 9422 7ff654ca69dd GetProcAddress 9419->9422 9423 7ff654ca2db0 10 API calls 9420->9423 9426 7ff654ca2db0 10 API calls 9421->9426 9424 7ff654ca6d00 9422->9424 9425 7ff654ca69f9 GetProcAddress 9422->9425 9423->9463 9429 7ff654ca2db0 10 API calls 9424->9429 9427 7ff654ca6a15 GetProcAddress 9425->9427 9428 7ff654ca6d18 9425->9428 9426->9463 9430 7ff654ca6a31 GetProcAddress 9427->9430 9431 7ff654ca6d48 9427->9431 9432 7ff654ca2db0 10 API calls 9428->9432 9429->9463 9434 7ff654ca6d30 9430->9434 9435 7ff654ca6a4d GetProcAddress 9430->9435 9433 7ff654ca2db0 10 API calls 9431->9433 9432->9463 9433->9463 9438 7ff654ca2db0 10 API calls 9434->9438 9436 7ff654ca6d90 9435->9436 9437 7ff654ca6a69 GetProcAddress 9435->9437 9441 7ff654ca2db0 10 API calls 9436->9441 9439 7ff654ca6a85 GetProcAddress 9437->9439 9440 7ff654ca6d78 9437->9440 9438->9463 9443 7ff654ca6aa1 GetProcAddress 9439->9443 9444 7ff654ca6d60 9439->9444 9442 7ff654ca2db0 10 API calls 9440->9442 9441->9463 9442->9463 9446 7ff654ca6da8 9443->9446 9447 7ff654ca6abd GetProcAddress 9443->9447 9445 7ff654ca2db0 10 API calls 9444->9445 9445->9463 9450 7ff654ca2db0 10 API calls 9446->9450 9448 7ff654ca6ad9 GetProcAddress 9447->9448 9449 7ff654ca6e08 9447->9449 9452 7ff654ca6df0 9448->9452 9453 7ff654ca6af5 GetProcAddress 9448->9453 9451 7ff654ca2db0 10 API calls 9449->9451 9450->9463 9451->9463 9454 7ff654ca2db0 10 API calls 9452->9454 9455 7ff654ca6b11 GetProcAddress 9453->9455 9456 7ff654ca6dd8 9453->9456 9454->9463 9458 7ff654ca6dc0 9455->9458 9459 7ff654ca6b2d GetProcAddress 9455->9459 9457 7ff654ca2db0 10 API calls 9456->9457 9457->9463 9460 7ff654ca2db0 10 API calls 9458->9460 9461 7ff654ca6e20 9459->9461 9462 7ff654ca6b49 GetProcAddress 9459->9462 9460->9463 9465 7ff654ca2db0 10 API calls 9461->9465 9462->9463 9464 7ff654ca6e38 9462->9464 9463->9107 9466 7ff654ca2db0 10 API calls 9464->9466 9465->9463 9466->9463 9468 7ff654ca6453 9467->9468 9469 7ff654ca2cd0 10 API calls 9468->9469 9472 7ff654ca64a3 9468->9472 9470 7ff654ca6500 9469->9470 9471 7ff654ca6310 FreeLibrary 9470->9471 9471->9472 9472->9107 9474 7ff654ca80a0 WideCharToMultiByte 9473->9474 9475 7ff654ca8053 9473->9475 9477 7ff654ca8140 9474->9477 9478 7ff654ca80e7 calloc 9474->9478 9476 7ff654ca805d WideCharToMultiByte 9475->9476 9479 7ff654ca8120 9476->9479 9485 7ff654ca8092 9476->9485 9481 7ff654ca2db0 10 API calls 9477->9481 9478->9476 9480 7ff654ca8101 9478->9480 9483 7ff654ca2db0 10 API calls 9479->9483 9486 7ff654ca2db0 GetLastError 9480->9486 9481->9485 9483->9485 9485->9170 9495 7ff654caf480 9486->9495 9490 7ff654ca2e0a 9512 7ff654ca2be0 9490->9512 9494 7ff654ca2e40 9494->9485 9496 7ff654caf4a2 9495->9496 9497 7ff654caf4cb 9495->9497 9523 7ff654cb15f5 9496->9523 9498 7ff654cb15f5 fputc 9497->9498 9500 7ff654ca2dfe 9498->9500 9501 7ff654ca7e50 9500->9501 9502 7ff654ca7e5c 9501->9502 9503 7ff654ca7f18 GetLastError 9502->9503 9504 7ff654ca7e6a FormatMessageW 9502->9504 9503->9504 9505 7ff654ca7ef0 9504->9505 9506 7ff654ca7e9c WideCharToMultiByte 9504->9506 9509 7ff654ca2db0 7 API calls 9505->9509 9507 7ff654ca7ee1 9506->9507 9508 7ff654ca7f30 9506->9508 9507->9490 9511 7ff654ca2db0 7 API calls 9508->9511 9510 7ff654ca7f03 9509->9510 9510->9490 9511->9507 9513 7ff654caf480 fputc 9512->9513 9514 7ff654ca2c04 9513->9514 9515 7ff654ca2c10 9514->9515 9516 7ff654ca2c1e 9515->9516 9517 7ff654ca8210 8 API calls 9516->9517 9518 7ff654ca2c6a 9517->9518 9519 7ff654ca2c6f 9518->9519 9520 7ff654ca2cb0 MessageBoxA 9518->9520 9521 7ff654ca8210 8 API calls 9519->9521 9520->9494 9522 7ff654ca2c88 MessageBoxW 9521->9522 9522->9494 9526 7ff654cb1614 9523->9526 9524 7ff654cb1fd5 9524->9500 9525 7ff654caf630 fputc 9525->9526 9526->9524 9526->9525 9528 7ff654caf480 fputc 9527->9528 9529 7ff654ca2e97 _errno 9528->9529 9530 7ff654ca2ea4 9529->9530 9531 7ff654ca2be0 fputc 9530->9531 9532 7ff654ca2ec5 9531->9532 9533 7ff654ca2c10 10 API calls 9532->9533 9534 7ff654ca2eda 9533->9534 9534->9176 9536 7ff654cae23f 9535->9536 9536->9181 9536->9536 9538 7ff654caf480 fputc 9537->9538 9539 7ff654ca2d12 9538->9539 9540 7ff654ca2c10 10 API calls 9539->9540 9541 7ff654ca2d27 9540->9541 9541->9187 9543 7ff654caf480 fputc 9542->9543 9544 7ff654ca1aa4 9543->9544 9544->9202 9544->9203 9546 7ff654ca404c 9545->9546 9582 7ff654ca4010 9546->9582 9551 7ff654ca4010 fputc 9552 7ff654ca2124 strcpy 9551->9552 9553 7ff654ca1e80 9552->9553 9554 7ff654ca2020 9553->9554 9555 7ff654ca1e96 9553->9555 9557 7ff654ca43b0 11 API calls 9554->9557 9556 7ff654ca7d30 5 API calls 9555->9556 9559 7ff654ca200c 9555->9559 9558 7ff654ca1ec0 9556->9558 9557->9555 9558->9559 9606 7ff654caf2c0 9558->9606 9559->9202 9559->9209 9562 7ff654ca1ee1 fread 9565 7ff654ca1f01 9562->9565 9566 7ff654ca2048 9562->9566 9563 7ff654ca2085 9564 7ff654ca2e50 11 API calls 9563->9564 9564->9559 9567 7ff654caf2c0 2 API calls 9565->9567 9568 7ff654ca2e50 11 API calls 9566->9568 9569 7ff654ca1f4b malloc 9567->9569 9568->9559 9570 7ff654ca1f67 fread 9569->9570 9571 7ff654ca209a 9569->9571 9573 7ff654ca1f81 ferror 9570->9573 9574 7ff654ca2062 9570->9574 9572 7ff654ca2e50 11 API calls 9571->9572 9572->9559 9576 7ff654ca2077 9573->9576 9579 7ff654ca1f9f 9573->9579 9575 7ff654ca2e50 11 API calls 9574->9575 9575->9559 9577 7ff654ca2cd0 10 API calls 9576->9577 9577->9559 9578 7ff654ca1ff3 9578->9559 9580 7ff654ca2000 fclose 9578->9580 9579->9578 9581 7ff654ca2cd0 10 API calls 9579->9581 9580->9559 9581->9579 9583 7ff654caf480 fputc 9582->9583 9584 7ff654ca4034 9583->9584 9584->9552 9585 7ff654cae5e0 9584->9585 9586 7ff654cae604 9585->9586 9587 7ff654cae61f setlocale 9586->9587 9588 7ff654cae60f _strdup 9586->9588 9589 7ff654cae63e 9587->9589 9590 7ff654caea6b wcstombs realloc wcstombs setlocale free 9587->9590 9588->9587 9589->9590 9591 7ff654cae64d mbstowcs 9589->9591 9592 7ff654ca4082 9590->9592 9593 7ff654cae230 9591->9593 9592->9551 9594 7ff654cae6a6 mbstowcs 9593->9594 9595 7ff654cae6f4 9594->9595 9596 7ff654cae75b 9594->9596 9595->9596 9598 7ff654cae735 setlocale free 9595->9598 9597 7ff654caea61 9596->9597 9599 7ff654cae78b 9596->9599 9597->9590 9598->9592 9600 7ff654cae80a wcstombs realloc wcstombs 9599->9600 9604 7ff654cae80f wcstombs 9599->9604 9602 7ff654caea3e setlocale free 9600->9602 9602->9592 9604->9602 9605 7ff654cae995 9604->9605 9605->9602 9609 7ff654caf300 9606->9609 9610 7ff654caf346 9609->9610 9614 7ff654caf31a 9609->9614 9611 7ff654caf388 _errno 9610->9611 9610->9614 9612 7ff654ca1ed9 9611->9612 9612->9562 9612->9563 9613 7ff654caf39a fsetpos 9613->9612 9614->9612 9614->9613 9618 7ff654caf3d0 fgetpos 9615->9618 9619 7ff654caf3c8 9618->9619 9619->9222 9621 7ff654ca1ad0 9620->9621 9622 7ff654ca1ac4 9620->9622 9623 7ff654ca2cd0 10 API calls 9621->9623 9622->9226 9624 7ff654ca1adc 9623->9624 9624->9226 9626 7ff654ca4010 fputc 9625->9626 9627 7ff654ca4101 9626->9627 9628 7ff654ca4178 9627->9628 9629 7ff654ca4124 strlen 9627->9629 9628->9243 9629->9628 9630 7ff654ca4139 9629->9630 9631 7ff654ca4160 9630->9631 9632 7ff654ca4149 strncat 9630->9632 9634 7ff654ca4165 strlen 9631->9634 9633 7ff654ca414e 9632->9633 9633->9243 9634->9633 9636 7ff654ca1b0e 9635->9636 9637 7ff654ca1bf0 9635->9637 9638 7ff654caf2c0 2 API calls 9636->9638 9639 7ff654ca43b0 11 API calls 9637->9639 9640 7ff654ca1b1e 9638->9640 9641 7ff654ca1c00 9639->9641 9642 7ff654ca1b26 malloc 9640->9642 9643 7ff654ca1c38 9640->9643 9641->9636 9644 7ff654ca1c10 9641->9644 9645 7ff654ca1b3f 9642->9645 9646 7ff654ca1c52 9642->9646 9648 7ff654ca2e50 11 API calls 9643->9648 9647 7ff654ca2cd0 10 API calls 9644->9647 9650 7ff654ca1bd0 9645->9650 9657 7ff654ca1b4b 9645->9657 9649 7ff654ca2e50 11 API calls 9646->9649 9651 7ff654ca1c21 9647->9651 9648->9651 9654 7ff654ca1b53 9649->9654 9662 7ff654ca1710 9650->9662 9651->9242 9653 7ff654ca1b60 fread 9656 7ff654ca1b86 9653->9656 9653->9657 9658 7ff654ca1bbf 9654->9658 9659 7ff654ca1bb2 fclose 9654->9659 9655 7ff654ca1be1 9655->9654 9661 7ff654ca1b9e free 9655->9661 9660 7ff654ca2e50 11 API calls 9656->9660 9657->9653 9657->9654 9658->9242 9659->9658 9660->9661 9661->9654 9683 7ff654ca8ae0 9662->9683 9664 7ff654ca1779 9665 7ff654ca1783 malloc 9664->9665 9666 7ff654ca19fb 9664->9666 9668 7ff654ca1799 malloc 9665->9668 9675 7ff654ca1a52 9665->9675 9667 7ff654ca2cd0 10 API calls 9666->9667 9678 7ff654ca17eb 9667->9678 9670 7ff654ca17af 9668->9670 9671 7ff654ca1a3b 9668->9671 9669 7ff654ca2e50 11 API calls 9669->9675 9673 7ff654ca17b3 fread 9670->9673 9672 7ff654ca2e50 11 API calls 9671->9672 9672->9675 9674 7ff654ca17db ferror 9673->9674 9676 7ff654ca18f5 9673->9676 9674->9676 9674->9678 9675->9669 9677 7ff654ca1902 free free 9676->9677 9677->9655 9678->9673 9678->9676 9679 7ff654ca1852 fwrite 9678->9679 9682 7ff654ca18c4 9678->9682 9681 7ff654ca187a ferror 9679->9681 9679->9682 9680 7ff654ca2cd0 10 API calls 9680->9676 9681->9678 9681->9682 9682->9676 9682->9680 9685 7ff654ca89f0 9683->9685 9684 7ff654ca8a53 9684->9664 9685->9684 9686 7ff654ca8a3e malloc 9685->9686 9686->9684 9780 7ff654ca7430 9687->9780 9690 7ff654ca1daf 9690->9261 9692 7ff654ca1cb3 9693 7ff654ca1cbf 9692->9693 9694 7ff654ca1e38 9692->9694 9695 7ff654ca1ccb 9693->9695 9698 7ff654ca43b0 11 API calls 9693->9698 9696 7ff654ca2e50 11 API calls 9694->9696 9697 7ff654caf2c0 2 API calls 9695->9697 9696->9690 9700 7ff654ca1cd9 9697->9700 9699 7ff654ca1dd0 9698->9699 9699->9695 9701 7ff654ca1ddf 9699->9701 9702 7ff654ca1ce1 9700->9702 9703 7ff654ca1e20 9700->9703 9704 7ff654ca2cd0 10 API calls 9701->9704 9706 7ff654ca1d80 9702->9706 9707 7ff654ca1ceb malloc 9702->9707 9705 7ff654ca2e50 11 API calls 9703->9705 9708 7ff654ca1d91 9704->9708 9705->9708 9709 7ff654ca1710 20 API calls 9706->9709 9710 7ff654ca1d01 9707->9710 9711 7ff654ca1e58 9707->9711 9717 7ff654ca1da7 fclose 9708->9717 9718 7ff654ca1d9b fclose 9708->9718 9709->9708 9712 7ff654ca1d36 fread 9710->9712 9722 7ff654ca1d09 free 9710->9722 9713 7ff654ca2e50 11 API calls 9711->9713 9715 7ff654ca1d10 fwrite 9712->9715 9716 7ff654ca1d5b 9712->9716 9714 7ff654ca1e6e 9713->9714 9714->9708 9715->9710 9719 7ff654ca1e00 9715->9719 9720 7ff654ca2e50 11 API calls 9716->9720 9717->9690 9718->9717 9723 7ff654ca2e50 11 API calls 9719->9723 9720->9722 9722->9708 9723->9722 9725 7ff654ca31c6 9724->9725 9925 7ff654ca3140 9725->9925 9728 7ff654ca3267 9732 7ff654ca2cd0 10 API calls 9728->9732 9744 7ff654ca3270 9728->9744 9729 7ff654ca4040 18 API calls 9730 7ff654ca321c 9729->9730 9930 7ff654ca30e0 9730->9930 9732->9728 9734 7ff654ca3244 9736 7ff654ca7430 59 API calls 9734->9736 9735 7ff654ca30e0 6 API calls 9737 7ff654ca32c5 9735->9737 9738 7ff654ca324c 9736->9738 9737->9734 9739 7ff654ca32cd 9737->9739 9738->9728 9935 7ff654ca7840 9738->9935 9740 7ff654ca30e0 6 API calls 9739->9740 9742 7ff654ca32ef 9740->9742 9743 7ff654ca32f7 9742->9743 9746 7ff654ca30e0 6 API calls 9742->9746 9745 7ff654ca7430 59 API calls 9743->9745 9779 7ff654ca33dc 9743->9779 9744->9261 9753 7ff654ca3300 9745->9753 9747 7ff654ca33b2 9746->9747 9747->9743 9750 7ff654ca30e0 6 API calls 9747->9750 9748 7ff654ca2cd0 10 API calls 9748->9728 9749 7ff654ca33e8 9752 7ff654ca21b0 12 API calls 9749->9752 9750->9743 9751 7ff654ca3335 strcmp 9751->9753 9756 7ff654ca3345 9751->9756 9754 7ff654ca33f5 9752->9754 9753->9749 9753->9751 9753->9779 9754->9779 9955 7ff654ca30b0 9754->9955 9755 7ff654ca3358 strcmp 9755->9756 9756->9744 9756->9755 9758 7ff654ca1c80 88 API calls 9756->9758 9759 7ff654ca1ab0 10 API calls 9756->9759 9762 7ff654ca34fe 9756->9762 9758->9756 9759->9756 9761 7ff654ca2cd0 10 API calls 9765 7ff654ca34ac 9761->9765 9764 7ff654ca2cd0 10 API calls 9762->9764 9763 7ff654ca30b0 fputc 9766 7ff654ca3447 9763->9766 9767 7ff654ca350d 9764->9767 9768 7ff654ca21f0 2 API calls 9765->9768 9770 7ff654ca30b0 fputc 9766->9770 9775 7ff654ca3494 9766->9775 9769 7ff654ca21f0 2 API calls 9767->9769 9768->9779 9769->9728 9771 7ff654ca3471 9770->9771 9772 7ff654ca1e80 22 API calls 9771->9772 9771->9775 9773 7ff654ca3490 9772->9773 9774 7ff654ca34de 9773->9774 9773->9775 9776 7ff654ca2e50 11 API calls 9774->9776 9775->9761 9777 7ff654ca34f4 9776->9777 9778 7ff654ca21f0 2 API calls 9777->9778 9778->9779 9779->9748 9781 7ff654ca7450 9780->9781 9787 7ff654ca1c97 9780->9787 9811 7ff654ca2230 strlen 9781->9811 9786 7ff654ca2cd0 10 API calls 9786->9787 9787->9690 9788 7ff654ca76b0 9787->9788 9789 7ff654ca76c2 9788->9789 9904 7ff654ca6ea0 9789->9904 9792 7ff654ca77c0 9792->9692 9793 7ff654ca6ea0 fputc 9794 7ff654ca770e 9793->9794 9794->9792 9795 7ff654ca7719 strlen 9794->9795 9809 7ff654ca7736 9795->9809 9796 7ff654ca77d8 9797 7ff654ca8210 10 API calls 9796->9797 9799 7ff654ca77f1 9797->9799 9798 7ff654ca7750 strlen 9798->9792 9800 7ff654ca7766 strlen strcpy strtok 9798->9800 9801 7ff654caf1bb 5 API calls 9799->9801 9800->9796 9800->9809 9802 7ff654ca77fe 9801->9802 9804 7ff654ca7802 9802->9804 9914 7ff654ca2d40 9802->9914 9803 7ff654ca8210 10 API calls 9803->9809 9805 7ff654ca43b0 11 API calls 9804->9805 9808 7ff654ca7811 9805->9808 9808->9692 9809->9796 9809->9798 9809->9803 9810 7ff654ca8440 13 API calls 9809->9810 9907 7ff654caf1bb 9809->9907 9810->9809 9813 7ff654ca2260 9811->9813 9812 7ff654ca228b 9815 7ff654ca7270 9812->9815 9813->9812 9814 7ff654ca2cd0 10 API calls 9813->9814 9814->9813 9816 7ff654ca7286 9815->9816 9817 7ff654ca7294 9816->9817 9818 7ff654ca72d9 GetTempPathW _getpid 9816->9818 9820 7ff654ca6fe0 15 API calls 9817->9820 9851 7ff654ca6e70 9818->9851 9822 7ff654ca72a0 9820->9822 9868 7ff654ca7110 9822->9868 9823 7ff654ca7319 _wtempnam 9854 7ff654ca8440 9823->9854 9826 7ff654ca72ab 9827 7ff654ca72b7 _wputenv_s free 9826->9827 9832 7ff654ca7363 9826->9832 9827->9818 9829 7ff654ca7380 9827->9829 9833 7ff654ca2cd0 10 API calls 9829->9833 9830 7ff654ca7331 free 9830->9823 9835 7ff654ca733e 9830->9835 9831 7ff654ca7390 9834 7ff654ca8040 13 API calls 9831->9834 9832->9786 9832->9787 9836 7ff654ca738c 9833->9836 9837 7ff654ca73a1 free 9834->9837 9835->9832 9839 7ff654ca73d8 9835->9839 9840 7ff654ca734c 9835->9840 9836->9832 9837->9832 9838 7ff654ca73ae 9837->9838 9841 7ff654ca73b3 9838->9841 9842 7ff654ca7404 9838->9842 9843 7ff654ca8210 10 API calls 9839->9843 9844 7ff654ca7070 13 API calls 9840->9844 9845 7ff654ca7070 13 API calls 9841->9845 9848 7ff654ca8210 10 API calls 9842->9848 9846 7ff654ca73e9 SetEnvironmentVariableW free 9843->9846 9847 7ff654ca735b free 9844->9847 9849 7ff654ca73c2 free 9845->9849 9846->9832 9847->9832 9850 7ff654ca7415 SetEnvironmentVariableW free 9848->9850 9849->9832 9850->9832 9890 7ff654caf520 9851->9890 9855 7ff654cae230 9854->9855 9856 7ff654ca8452 GetCurrentProcess OpenProcessToken 9855->9856 9857 7ff654ca8540 GetTokenInformation 9856->9857 9858 7ff654ca8496 9856->9858 9860 7ff654ca8576 calloc 9857->9860 9861 7ff654ca8567 GetLastError 9857->9861 9859 7ff654ca849d free 9858->9859 9863 7ff654ca84b0 CloseHandle 9859->9863 9864 7ff654ca84b6 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 9859->9864 9860->9858 9862 7ff654ca8598 GetTokenInformation 9860->9862 9861->9858 9861->9860 9862->9859 9865 7ff654ca85b7 ConvertSidToStringSidW 9862->9865 9863->9864 9866 7ff654ca732d 9864->9866 9867 7ff654ca8515 CreateDirectoryW 9864->9867 9865->9859 9866->9830 9866->9831 9867->9866 9869 7ff654ca711e 9868->9869 9870 7ff654ca8210 10 API calls 9869->9870 9871 7ff654ca712e 9870->9871 9872 7ff654ca7250 9871->9872 9873 7ff654ca713a ExpandEnvironmentStringsW free 9871->9873 9874 7ff654ca2cd0 10 API calls 9872->9874 9875 7ff654ca7230 9873->9875 9876 7ff654ca7163 9873->9876 9879 7ff654ca723e 9874->9879 9878 7ff654ca2cd0 10 API calls 9875->9878 9902 7ff654ca8650 wcslen 9876->9902 9878->9879 9879->9826 9880 7ff654ca716b 9881 7ff654ca7173 _wfullpath 9880->9881 9882 7ff654ca7218 _wcsdup 9880->9882 9883 7ff654ca7187 9881->9883 9882->9883 9884 7ff654ca7260 9883->9884 9885 7ff654ca7190 wcschr 9883->9885 9886 7ff654ca2cd0 10 API calls 9884->9886 9887 7ff654ca71c1 9885->9887 9888 7ff654ca71fd CreateDirectoryW 9885->9888 9886->9879 9889 7ff654ca71c8 wcsncpy CreateDirectoryW wcschr 9887->9889 9888->9826 9889->9888 9889->9889 9891 7ff654caf542 9890->9891 9892 7ff654caf56b 9890->9892 9896 7ff654cb4103 _errno 9891->9896 9893 7ff654cb4103 4 API calls 9892->9893 9895 7ff654ca6e94 9893->9895 9895->9823 9900 7ff654cb4180 9896->9900 9897 7ff654cb4b6f 9898 7ff654cb4ba8 9897->9898 9899 7ff654cb2378 fputwc fwprintf fwprintf 9897->9899 9898->9895 9899->9898 9900->9897 9901 7ff654cb2378 fputwc fwprintf fwprintf 9900->9901 9901->9900 9903 7ff654ca866b 9902->9903 9903->9880 9905 7ff654caf480 fputc 9904->9905 9906 7ff654ca6ec4 9905->9906 9906->9792 9906->9793 9919 7ff654caefd0 9907->9919 9909 7ff654caf1d7 9910 7ff654caf204 9909->9910 9911 7ff654caf1f8 free 9909->9911 9912 7ff654caf20a memset 9910->9912 9913 7ff654caf22b 9910->9913 9911->9910 9912->9913 9913->9809 9915 7ff654caf480 fputc 9914->9915 9916 7ff654ca2d82 9915->9916 9917 7ff654ca2c10 10 API calls 9916->9917 9918 7ff654ca2d97 9917->9918 9918->9804 9920 7ff654caf031 9919->9920 9921 7ff654caefef 9919->9921 9920->9909 9921->9920 9922 7ff654caefff wcslen 9921->9922 9922->9920 9924 7ff654caf014 9922->9924 9923 7ff654caf166 malloc memcpy 9923->9920 9924->9920 9924->9923 9926 7ff654ca30b0 fputc 9925->9926 9927 7ff654ca3160 9926->9927 9928 7ff654ca3179 strcpy 9927->9928 9929 7ff654ca318d 9927->9929 9928->9929 9929->9728 9929->9729 9931 7ff654caf480 fputc 9930->9931 9932 7ff654ca3112 9931->9932 9933 7ff654ca3126 9932->9933 9958 7ff654caed0a 9932->9958 9933->9734 9933->9735 9936 7ff654ca784d 9935->9936 9937 7ff654ca43b0 11 API calls 9936->9937 9938 7ff654ca7862 9937->9938 9939 7ff654ca76b0 34 API calls 9938->9939 9940 7ff654ca7870 9939->9940 9941 7ff654ca7939 9940->9941 9942 7ff654ca792c 9940->9942 9946 7ff654ca7885 9940->9946 9943 7ff654ca793e fclose 9941->9943 9945 7ff654ca7916 9941->9945 9942->9941 9944 7ff654ca7931 fclose 9942->9944 9943->9945 9944->9941 9945->9728 9947 7ff654ca78a0 fread 9946->9947 9948 7ff654ca7901 fclose fclose 9946->9948 9950 7ff654ca78be ferror 9947->9950 9951 7ff654ca78d8 fwrite 9947->9951 9948->9945 9950->9946 9952 7ff654ca78ca clearerr 9950->9952 9953 7ff654ca78f9 clearerr 9951->9953 9954 7ff654ca78ed ferror 9951->9954 9952->9948 9953->9948 9954->9946 9954->9953 9956 7ff654caf480 fputc 9955->9956 9957 7ff654ca30cd 9956->9957 9957->9763 9957->9775 9965 7ff654caeb50 9958->9965 9960 7ff654caed26 9961 7ff654caed53 9960->9961 9962 7ff654caed47 free 9960->9962 9963 7ff654caed59 memset 9961->9963 9964 7ff654caed7a 9961->9964 9962->9961 9963->9964 9964->9933 9966 7ff654caebae 9965->9966 9967 7ff654caeb6f 9965->9967 9966->9960 9967->9966 9968 7ff654caeb7e strlen 9967->9968 9968->9966 9970 7ff654caeb93 9968->9970 9969 7ff654caecc0 malloc memcpy 9969->9966 9970->9966 9970->9969 9971->9285 9972->9288 9974 7ff654caee41 9973->9974 9975 7ff654caee75 memcpy 9974->9975 9976 7ff654caee52 memset 9974->9976 9977 7ff654ca751e 9975->9977 9976->9977 9977->9299 9978 7ff654ca75d0 9977->9978 9979 7ff654ca75de 9978->9979 9980 7ff654ca7610 wcscmp 9979->9980 9992 7ff654ca7601 9979->9992 9981 7ff654ca7623 wcscat 9980->9981 9980->9992 9982 7ff654ca7670 _wremove 9981->9982 9983 7ff654ca763d 9981->9983 9985 7ff654ca767d Sleep _wremove 9982->9985 9982->9992 9998 7ff654ca85e0 FindFirstFileExW 9983->9998 9985->9992 9987 7ff654ca7646 9989 7ff654ca8040 13 API calls 9987->9989 9988 7ff654ca7698 _wrmdir 9988->9992 9990 7ff654ca765c 9989->9990 9991 7ff654ca7490 24 API calls 9990->9991 9991->9992 9992->9301 9994 7ff654caef21 9993->9994 9995 7ff654caef30 memset 9994->9995 9996 7ff654caef51 memcpy 9994->9996 9997 7ff654caefc1 9995->9997 9996->9997 9997->9301 9999 7ff654ca7642 9998->9999 10000 7ff654ca8614 FindClose 9998->10000 9999->9987 9999->9988 10000->9999 10002 7ff654ca51de 10001->10002 10079 7ff654ca4f60 10002->10079 10005 7ff654ca5210 10009 7ff654ca40e0 4 API calls 10005->10009 10026 7ff654ca521f 10005->10026 10006 7ff654ca52e7 10007 7ff654ca2cd0 10 API calls 10006->10007 10008 7ff654ca3aad 10007->10008 10008->9324 10027 7ff654ca5550 10008->10027 10011 7ff654ca5289 10009->10011 10010 7ff654ca40e0 4 API calls 10012 7ff654ca5234 10010->10012 10013 7ff654ca528e 10011->10013 10018 7ff654ca2cd0 10 API calls 10011->10018 10014 7ff654ca5239 10012->10014 10016 7ff654ca2cd0 10 API calls 10012->10016 10252 7ff654ca4210 10013->10252 10082 7ff654ca7950 10014->10082 10016->10014 10018->10013 10020 7ff654ca5241 10021 7ff654ca5309 10020->10021 10022 7ff654ca524d 10020->10022 10023 7ff654ca2db0 10 API calls 10021->10023 10085 7ff654ca4410 GetProcAddress 10022->10085 10023->10008 10024 7ff654ca7950 12 API calls 10024->10026 10026->10010 10028 7ff654ca6fe0 15 API calls 10027->10028 10031 7ff654ca5566 10028->10031 10029 7ff654ca5586 10030 7ff654ca8210 10 API calls 10029->10030 10032 7ff654ca55d2 10030->10032 10031->10029 10033 7ff654ca2d40 10 API calls 10031->10033 10034 7ff654ca55db 10032->10034 10035 7ff654ca579c 10032->10035 10033->10029 10037 7ff654ca8210 10 API calls 10034->10037 10036 7ff654ca2cd0 10 API calls 10035->10036 10058 7ff654ca3ac3 10036->10058 10038 7ff654ca5606 10037->10038 10039 7ff654ca560f 10038->10039 10040 7ff654ca57b8 10038->10040 10042 7ff654ca4f60 fputc 10039->10042 10041 7ff654ca2cd0 10 API calls 10040->10041 10041->10058 10043 7ff654ca567b 10042->10043 10044 7ff654ca5777 10043->10044 10045 7ff654ca5686 10043->10045 10046 7ff654ca2cd0 10 API calls 10044->10046 10047 7ff654ca8210 10 API calls 10045->10047 10046->10058 10048 7ff654ca569e 10047->10048 10049 7ff654ca56a7 10048->10049 10050 7ff654ca57aa 10048->10050 10258 7ff654ca4fb0 10049->10258 10051 7ff654ca2cd0 10 API calls 10050->10051 10051->10058 10055 7ff654ca56eb 10056 7ff654ca578e 10055->10056 10059 7ff654ca56f7 10055->10059 10057 7ff654ca2cd0 10 API calls 10056->10057 10057->10058 10058->9324 10064 7ff654ca57d0 strlen 10058->10064 10060 7ff654ca5732 free 10059->10060 10061 7ff654ca5720 free 10059->10061 10062 7ff654ca5743 10060->10062 10061->10060 10061->10061 10062->10058 10063 7ff654ca2cd0 10 API calls 10062->10063 10063->10058 10065 7ff654ca580d 10064->10065 10066 7ff654ca58f1 10065->10066 10073 7ff654ca5819 10065->10073 10067 7ff654ca2cd0 10 API calls 10066->10067 10068 7ff654ca3acf 10067->10068 10068->9324 10074 7ff654ca59e0 10068->10074 10069 7ff654ca1ab0 10 API calls 10069->10073 10070 7ff654ca1af0 27 API calls 10070->10073 10071 7ff654ca2cd0 10 API calls 10071->10073 10072 7ff654ca58b9 free 10072->10073 10073->10068 10073->10069 10073->10070 10073->10071 10073->10072 10075 7ff654ca59f2 10074->10075 10076 7ff654ca59f8 10074->10076 10075->9324 10076->10075 10077 7ff654ca1ab0 10 API calls 10076->10077 10282 7ff654ca5910 strlen 10076->10282 10077->10076 10080 7ff654caf480 fputc 10079->10080 10081 7ff654ca4f78 10080->10081 10081->10005 10081->10006 10083 7ff654ca8210 10 API calls 10082->10083 10084 7ff654ca7963 LoadLibraryExW free 10083->10084 10084->10020 10086 7ff654ca4a81 10085->10086 10087 7ff654ca443c GetProcAddress 10085->10087 10088 7ff654ca2db0 10 API calls 10086->10088 10089 7ff654ca4458 GetProcAddress 10087->10089 10090 7ff654ca4a6c 10087->10090 10249 7ff654ca4a14 10088->10249 10092 7ff654ca4474 GetProcAddress 10089->10092 10093 7ff654ca4a57 10089->10093 10091 7ff654ca2db0 10 API calls 10090->10091 10091->10249 10094 7ff654ca4af0 10092->10094 10095 7ff654ca4490 GetProcAddress 10092->10095 10096 7ff654ca2db0 10 API calls 10093->10096 10097 7ff654ca2db0 10 API calls 10094->10097 10098 7ff654ca4ad8 10095->10098 10099 7ff654ca44ac GetProcAddress 10095->10099 10096->10249 10097->10249 10102 7ff654ca2db0 10 API calls 10098->10102 10100 7ff654ca4ac0 10099->10100 10101 7ff654ca44c8 GetProcAddress 10099->10101 10105 7ff654ca2db0 10 API calls 10100->10105 10103 7ff654ca44e4 GetProcAddress 10101->10103 10104 7ff654ca4aab 10101->10104 10102->10249 10106 7ff654ca4500 GetProcAddress 10103->10106 10107 7ff654ca4a96 10103->10107 10108 7ff654ca2db0 10 API calls 10104->10108 10105->10249 10110 7ff654ca4f28 10106->10110 10111 7ff654ca451c 10106->10111 10109 7ff654ca2db0 10 API calls 10107->10109 10108->10249 10109->10249 10114 7ff654ca2db0 10 API calls 10110->10114 10112 7ff654ca4a20 GetProcAddress 10111->10112 10113 7ff654ca4528 GetProcAddress 10111->10113 10112->10113 10115 7ff654ca4a3c 10112->10115 10116 7ff654ca4b50 10113->10116 10117 7ff654ca4544 GetProcAddress 10113->10117 10114->10249 10118 7ff654ca2db0 10 API calls 10115->10118 10121 7ff654ca2db0 10 API calls 10116->10121 10119 7ff654ca4560 GetProcAddress 10117->10119 10120 7ff654ca4b38 10117->10120 10118->10249 10122 7ff654ca4b20 10119->10122 10123 7ff654ca457c GetProcAddress 10119->10123 10124 7ff654ca2db0 10 API calls 10120->10124 10121->10249 10125 7ff654ca2db0 10 API calls 10122->10125 10126 7ff654ca4b08 10123->10126 10127 7ff654ca4598 GetProcAddress 10123->10127 10124->10249 10125->10249 10128 7ff654ca2db0 10 API calls 10126->10128 10129 7ff654ca4bb0 10127->10129 10130 7ff654ca45b4 GetProcAddress 10127->10130 10128->10249 10131 7ff654ca2db0 10 API calls 10129->10131 10132 7ff654ca45d0 GetProcAddress 10130->10132 10133 7ff654ca4b98 10130->10133 10131->10249 10135 7ff654ca4b80 10132->10135 10136 7ff654ca45ec GetProcAddress 10132->10136 10134 7ff654ca2db0 10 API calls 10133->10134 10134->10249 10137 7ff654ca2db0 10 API calls 10135->10137 10138 7ff654ca4b68 10136->10138 10139 7ff654ca4608 GetProcAddress 10136->10139 10137->10249 10140 7ff654ca2db0 10 API calls 10138->10140 10141 7ff654ca4be0 10139->10141 10142 7ff654ca4624 GetProcAddress 10139->10142 10140->10249 10145 7ff654ca2db0 10 API calls 10141->10145 10143 7ff654ca4640 GetProcAddress 10142->10143 10144 7ff654ca4bc8 10142->10144 10146 7ff654ca4c10 10143->10146 10147 7ff654ca465c GetProcAddress 10143->10147 10148 7ff654ca2db0 10 API calls 10144->10148 10145->10249 10151 7ff654ca2db0 10 API calls 10146->10151 10149 7ff654ca4bf8 10147->10149 10150 7ff654ca4678 GetProcAddress 10147->10150 10148->10249 10152 7ff654ca2db0 10 API calls 10149->10152 10153 7ff654ca4694 GetProcAddress 10150->10153 10154 7ff654ca4c58 10150->10154 10151->10249 10152->10249 10155 7ff654ca4c40 10153->10155 10156 7ff654ca46b0 GetProcAddress 10153->10156 10157 7ff654ca2db0 10 API calls 10154->10157 10160 7ff654ca2db0 10 API calls 10155->10160 10158 7ff654ca4c28 10156->10158 10159 7ff654ca46cc GetProcAddress 10156->10159 10157->10249 10163 7ff654ca2db0 10 API calls 10158->10163 10161 7ff654ca4c70 10159->10161 10162 7ff654ca46e8 GetProcAddress 10159->10162 10160->10249 10164 7ff654ca2db0 10 API calls 10161->10164 10165 7ff654ca4704 GetProcAddress 10162->10165 10166 7ff654ca4ce8 10162->10166 10163->10249 10164->10249 10167 7ff654ca4cd0 10165->10167 10168 7ff654ca4720 GetProcAddress 10165->10168 10169 7ff654ca2db0 10 API calls 10166->10169 10172 7ff654ca2db0 10 API calls 10167->10172 10170 7ff654ca4cb8 10168->10170 10171 7ff654ca473c GetProcAddress 10168->10171 10169->10249 10173 7ff654ca2db0 10 API calls 10170->10173 10174 7ff654ca4ca0 10171->10174 10175 7ff654ca4758 GetProcAddress 10171->10175 10172->10249 10173->10249 10176 7ff654ca2db0 10 API calls 10174->10176 10177 7ff654ca4774 GetProcAddress 10175->10177 10178 7ff654ca4c88 10175->10178 10176->10249 10180 7ff654ca4d00 10177->10180 10181 7ff654ca4790 GetProcAddress 10177->10181 10179 7ff654ca2db0 10 API calls 10178->10179 10179->10249 10182 7ff654ca2db0 10 API calls 10180->10182 10183 7ff654ca4d30 10181->10183 10184 7ff654ca47ac GetProcAddress 10181->10184 10182->10249 10185 7ff654ca2db0 10 API calls 10183->10185 10186 7ff654ca4d18 10184->10186 10187 7ff654ca47c8 GetProcAddress 10184->10187 10185->10249 10188 7ff654ca2db0 10 API calls 10186->10188 10189 7ff654ca4d60 10187->10189 10190 7ff654ca47e4 GetProcAddress 10187->10190 10188->10249 10193 7ff654ca2db0 10 API calls 10189->10193 10191 7ff654ca4800 GetProcAddress 10190->10191 10192 7ff654ca4d48 10190->10192 10194 7ff654ca4d90 10191->10194 10195 7ff654ca481c GetProcAddress 10191->10195 10196 7ff654ca2db0 10 API calls 10192->10196 10193->10249 10199 7ff654ca2db0 10 API calls 10194->10199 10197 7ff654ca4d78 10195->10197 10198 7ff654ca4838 GetProcAddress 10195->10198 10196->10249 10200 7ff654ca2db0 10 API calls 10197->10200 10201 7ff654ca4df0 10198->10201 10202 7ff654ca4854 GetProcAddress 10198->10202 10199->10249 10200->10249 10203 7ff654ca2db0 10 API calls 10201->10203 10204 7ff654ca4870 GetProcAddress 10202->10204 10205 7ff654ca4dd8 10202->10205 10203->10249 10206 7ff654ca4dc0 10204->10206 10207 7ff654ca488c GetProcAddress 10204->10207 10208 7ff654ca2db0 10 API calls 10205->10208 10211 7ff654ca2db0 10 API calls 10206->10211 10209 7ff654ca4da8 10207->10209 10210 7ff654ca48a8 GetProcAddress 10207->10210 10208->10249 10212 7ff654ca2db0 10 API calls 10209->10212 10213 7ff654ca4e80 10210->10213 10214 7ff654ca48c4 GetProcAddress 10210->10214 10211->10249 10212->10249 10215 7ff654ca2db0 10 API calls 10213->10215 10216 7ff654ca48e0 GetProcAddress 10214->10216 10217 7ff654ca4e68 10214->10217 10215->10249 10218 7ff654ca4e50 10216->10218 10219 7ff654ca48fc GetProcAddress 10216->10219 10220 7ff654ca2db0 10 API calls 10217->10220 10223 7ff654ca2db0 10 API calls 10218->10223 10221 7ff654ca4e38 10219->10221 10222 7ff654ca4918 GetProcAddress 10219->10222 10220->10249 10224 7ff654ca2db0 10 API calls 10221->10224 10225 7ff654ca4e20 10222->10225 10226 7ff654ca4934 GetProcAddress 10222->10226 10223->10249 10224->10249 10227 7ff654ca2db0 10 API calls 10225->10227 10228 7ff654ca4950 GetProcAddress 10226->10228 10229 7ff654ca4e08 10226->10229 10227->10249 10231 7ff654ca4f10 10228->10231 10232 7ff654ca496c GetProcAddress 10228->10232 10230 7ff654ca2db0 10 API calls 10229->10230 10230->10249 10233 7ff654ca2db0 10 API calls 10231->10233 10234 7ff654ca4ef8 10232->10234 10235 7ff654ca4988 GetProcAddress 10232->10235 10233->10249 10236 7ff654ca2db0 10 API calls 10234->10236 10237 7ff654ca4ee0 10235->10237 10238 7ff654ca49a4 GetProcAddress 10235->10238 10236->10249 10241 7ff654ca2db0 10 API calls 10237->10241 10239 7ff654ca49c0 GetProcAddress 10238->10239 10240 7ff654ca4ec8 10238->10240 10242 7ff654ca4eb0 10239->10242 10243 7ff654ca49dc GetProcAddress 10239->10243 10244 7ff654ca2db0 10 API calls 10240->10244 10241->10249 10247 7ff654ca2db0 10 API calls 10242->10247 10245 7ff654ca4e98 10243->10245 10246 7ff654ca49f8 GetProcAddress 10243->10246 10244->10249 10250 7ff654ca2db0 10 API calls 10245->10250 10248 7ff654ca4f40 10246->10248 10246->10249 10247->10249 10251 7ff654ca2db0 10 API calls 10248->10251 10249->10008 10250->10249 10251->10249 10253 7ff654ca421b 10252->10253 10254 7ff654ca8210 10 API calls 10253->10254 10255 7ff654ca4234 10254->10255 10256 7ff654caf1bb 5 API calls 10255->10256 10257 7ff654ca4241 10256->10257 10257->10024 10257->10026 10261 7ff654ca4fc4 10258->10261 10259 7ff654ca5062 strncmp 10259->10261 10260 7ff654ca1ab0 10 API calls 10260->10261 10261->10259 10261->10260 10262 7ff654ca508a mbstowcs 10261->10262 10263 7ff654ca50d8 10261->10263 10267 7ff654ca50dd 10261->10267 10262->10261 10264 7ff654ca51b6 10262->10264 10266 7ff654ca512b _setmode 10263->10266 10263->10267 10265 7ff654ca2cd0 10 API calls 10264->10265 10265->10267 10268 7ff654ca5142 _fileno _setmode 10266->10268 10274 7ff654ca8310 calloc 10267->10274 10269 7ff654ca515a fflush 10268->10269 10270 7ff654ca5169 fflush 10269->10270 10271 7ff654ca5175 10270->10271 10272 7ff654ca5186 setbuf 10271->10272 10273 7ff654ca5197 setbuf 10272->10273 10273->10267 10275 7ff654ca8389 10274->10275 10278 7ff654ca8336 10274->10278 10275->10055 10276 7ff654ca83a0 10276->10055 10277 7ff654ca8210 10 API calls 10277->10278 10278->10276 10278->10277 10279 7ff654ca8361 10278->10279 10280 7ff654ca8370 free 10279->10280 10280->10280 10281 7ff654ca8381 free 10280->10281 10281->10275 10283 7ff654ca5947 10282->10283 10284 7ff654ca59bc 10283->10284 10287 7ff654ca5987 10283->10287 10285 7ff654ca2cd0 10 API calls 10284->10285 10286 7ff654ca5997 10285->10286 10286->10076 10287->10286 10288 7ff654ca2cd0 10 API calls 10287->10288 10289 7ff654ca59b0 10288->10289 10289->10076 10291 7ff654ca2300 10290->10291 10292 7ff654ca2335 10291->10292 10293 7ff654ca2cd0 10 API calls 10291->10293 10292->9343 10293->10291 10297 7ff654cae270 setlocale 10294->10297 10298 7ff654cae2af setlocale 10297->10298 10299 7ff654cae29f _strdup 10297->10299 10300 7ff654cae2ce 10298->10300 10301 7ff654cae54d wcstombs realloc wcstombs setlocale free 10298->10301 10299->10298 10300->10301 10303 7ff654cae2dd mbstowcs 10300->10303 10302 7ff654ca40c0 strcpy 10301->10302 10302->9358 10304 7ff654cae230 10303->10304 10305 7ff654cae336 mbstowcs 10304->10305 10306 7ff654cae376 10305->10306 10307 7ff654cae54a 10306->10307 10313 7ff654cae3aa 10306->10313 10307->10301 10308 7ff654cae4c0 wcstombs realloc wcstombs 10312 7ff654cae521 setlocale free 10308->10312 10309 7ff654cae45b wcstombs 10310 7ff654cae47d 10309->10310 10311 7ff654cae48b wcstombs 10309->10311 10310->10311 10311->10312 10314 7ff654cae4b6 10311->10314 10312->10302 10313->10308 10313->10309 10314->10312 10745 7ff654ca9330 10746 7ff654ca933e 10745->10746 10747 7ff654ca935c memcpy 10746->10747 10749 7ff654ca8cd1 10746->10749 10747->10749 10748 7ff654ca86b0 4 API calls 10748->10749 10749->10748 10750 7ff654ca8bfb 10749->10750 11308 7ff654ca8f80 11310 7ff654ca8bfb 11308->11310 11311 7ff654ca8cda 11308->11311 11309 7ff654ca86b0 4 API calls 11309->11311 11311->11309 11311->11310 11504 7ff654ca93b0 11505 7ff654ca8ff5 11504->11505 11507 7ff654ca910d 11504->11507 11506 7ff654ca86b0 4 API calls 11505->11506 11505->11507 11506->11505 11717 7ff654ca8c60 11720 7ff654ca8c65 11717->11720 11718 7ff654ca86b0 4 API calls 11718->11720 11719 7ff654ca8bfb 11720->11718 11720->11719 9056 7ff654ca9458 9058 7ff654ca8cda 9056->9058 9057 7ff654ca8bfb 9058->9057 9060 7ff654ca86b0 9058->9060 9061 7ff654ca8770 malloc 9060->9061 9062 7ff654ca86d2 9060->9062 9061->9062 9065 7ff654ca871b 9061->9065 9063 7ff654ca86f2 memcpy 9062->9063 9064 7ff654ca8748 memcpy 9062->9064 9063->9065 9066 7ff654ca87b0 memcpy 9063->9066 9064->9065 9065->9058 9066->9065

                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                          Function 00007FF654CA1154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _initterm$_amsg_exit_cexitexit
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 602970348-4108050209
                                                                                                                                                                                                          • Opcode ID: 6d6abd2140eb0b7f68bb3c504690dcf92132bdf22886463ef4a851639e3c59bc
                                                                                                                                                                                                          • Instruction ID: 4612fabad723a35932750a26ade81000d56b3253715170873d3ec5c8c1b4e406
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d6abd2140eb0b7f68bb3c504690dcf92132bdf22886463ef4a851639e3c59bc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8B6194A5F09B0689FB009B96E8E436833B0BB84B84F4844B6DE5DE77A5DE3CE4418750
                                                                                                                                                                                                          Function 00007FF654CA8C60 Relevance: 6.9, Strings: 5, Instructions: 602COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
                                                                                                                                                                                                          • API String ID: 0-817236767
                                                                                                                                                                                                          • Opcode ID: ad7465917ce0bd69c915d26ccdd0654c50e183496f1a9639a8706ff0dce767b6
                                                                                                                                                                                                          • Instruction ID: 7425fac036edb0e2d28438c2113d62e9721003a965375a0cb7f411b3755a4ba5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ad7465917ce0bd69c915d26ccdd0654c50e183496f1a9639a8706ff0dce767b6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C842E2B3E192928BD3508F26D49893E7BB5FB84784F19417ADA4AD7784DF38E904DB00
                                                                                                                                                                                                          Function 00007FF654CA9458 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
                                                                                                                                                                                                          • API String ID: 0-1153561608
                                                                                                                                                                                                          • Opcode ID: 47164a0fb7dc88aad6f9100fbe571ed17c27b01c48b102c533af20c39b644f9d
                                                                                                                                                                                                          • Instruction ID: 6f28f83da5bedae8d3af34aef5f86b0e215c9b0a4fa98f67d53df7a5d9072490
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 47164a0fb7dc88aad6f9100fbe571ed17c27b01c48b102c533af20c39b644f9d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E1F1E4B2A186528BD7548F26D4D8A7E77F4FB84784F0A417ADB4A97780DF38E944CB00
                                                                                                                                                                                                          Function 00007FF654CA85E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                          • Opcode ID: e52f2938a18a37d305d9bb5fab71544ce8426dd77b6bb2e1cf10f581b4471b50
                                                                                                                                                                                                          • Instruction ID: 7d928cd83c8d8d6d00146a290b16316861d7f147436f1b685e0d7133dc2fa58e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e52f2938a18a37d305d9bb5fab71544ce8426dd77b6bb2e1cf10f581b4471b50
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25F0E569E2D68182F7E09B60F44876923A0EBC43B8F880775DA7D916D4CFBCC14ACB00
                                                                                                                                                                                                          Function 00007FF654CA1C80 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 123COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$fclose$freadfreemallocstrcpystrtok
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                          • API String ID: 790192563-666925554
                                                                                                                                                                                                          • Opcode ID: 2eb8a89695d0905b6aac32925b17d146fc58dee4761c266095f8ad691f51bfc2
                                                                                                                                                                                                          • Instruction ID: 5d8936f683f5ecfed94953b87fe6d7f503a50193c404997fd602b43de507e3d5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2eb8a89695d0905b6aac32925b17d146fc58dee4761c266095f8ad691f51bfc2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41419CA5F0960250FB559B22D8F02B92271AFC5B94FCC45B3DE1EAB3D2EE2CE5458300
                                                                                                                                                                                                          Function 00007FF654CA7270 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 118COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wputenv_s.MSVCRT ref: 00007FF654CA72C1
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA72CC
                                                                                                                                                                                                          • GetTempPathW.KERNEL32 ref: 00007FF654CA72F0
                                                                                                                                                                                                          • _getpid.MSVCRT(?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA72F6
                                                                                                                                                                                                          • _wtempnam.MSVCRT ref: 00007FF654CA731F
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA7334
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA735E
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA6FE0: GetEnvironmentVariableW.KERNEL32 ref: 00007FF654CA700C
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF654CA714B
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: free.MSVCRT ref: 00007FF654CA7156
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: _wfullpath.MSVCRT ref: 00007FF654CA717E
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71AD
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcsncpy.MSVCRT ref: 00007FF654CA71DB
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71E5
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71F0
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA7202
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                                                                                                                                                                                          • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                          • API String ID: 2180377646-1116378104
                                                                                                                                                                                                          • Opcode ID: a3b2ec564969b41e7f7f1f3776da53e2cae86a4f4f371a759b53bcdcc7010f3f
                                                                                                                                                                                                          • Instruction ID: f62146a0d111edc9aa6a38346515cddbce1d3ae4a64bb84879afd9183c586abf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a3b2ec564969b41e7f7f1f3776da53e2cae86a4f4f371a759b53bcdcc7010f3f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB415B91E4A50301FA55A723ADB56B652726FC5BD1F8C84B7EC0EE7792ED3CE4498200
                                                                                                                                                                                                          Function 00007FF654CA1710 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 198fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 87 7ff654ca1710-7ff654ca177d call 7ff654ca8ae0 90 7ff654ca1783-7ff654ca1793 malloc 87->90 91 7ff654ca19fb-7ff654ca1a13 call 7ff654ca2cd0 87->91 93 7ff654ca1799-7ff654ca17a9 malloc 90->93 94 7ff654ca1a5a-7ff654ca1a71 call 7ff654ca2e50 90->94 104 7ff654ca1a18-7ff654ca1a36 91->104 97 7ff654ca17af 93->97 98 7ff654ca1a3b-7ff654ca1a4d call 7ff654ca2e50 93->98 105 7ff654ca1a52 94->105 101 7ff654ca17b3-7ff654ca17d5 fread 97->101 98->105 102 7ff654ca18f5 101->102 103 7ff654ca17db-7ff654ca17e5 ferror 101->103 107 7ff654ca18fa-7ff654ca1927 call 7ff654caa970 free * 2 102->107 103->102 106 7ff654ca17eb-7ff654ca1805 103->106 108 7ff654ca1990-7ff654ca1998 104->108 105->94 109 7ff654ca1808-7ff654ca1824 call 7ff654ca8b90 106->109 111 7ff654ca1893-7ff654ca1895 108->111 118 7ff654ca18d0-7ff654ca18d3 109->118 119 7ff654ca182a-7ff654ca182d 109->119 111->109 114 7ff654ca189b-7ff654ca18b5 111->114 116 7ff654ca1a73-7ff654ca1a75 114->116 117 7ff654ca18bb-7ff654ca18be 114->117 116->107 117->101 120 7ff654ca18c4-7ff654ca18cc 117->120 121 7ff654ca1833-7ff654ca184c 118->121 122 7ff654ca18d9-7ff654ca18dc 118->122 119->121 123 7ff654ca1930-7ff654ca1936 119->123 120->107 124 7ff654ca18ce 120->124 126 7ff654ca1940-7ff654ca1949 121->126 127 7ff654ca1852-7ff654ca1874 fwrite 121->127 125 7ff654ca18e2-7ff654ca18f0 call 7ff654ca2cd0 122->125 123->125 124->125 125->102 126->111 131 7ff654ca194f-7ff654ca1953 126->131 129 7ff654ca187a-7ff654ca1889 ferror 127->129 130 7ff654ca19ed-7ff654ca19f6 127->130 129->130 132 7ff654ca188f 129->132 130->125 133 7ff654ca19a0-7ff654ca19eb 131->133 134 7ff654ca1955-7ff654ca1959 131->134 132->111 133->108 134->104 135 7ff654ca195f-7ff654ca1962 134->135 135->108 136 7ff654ca1964-7ff654ca1975 135->136 136->108 137 7ff654ca1977-7ff654ca198b 136->137 137->108
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc$ferrorfree$freadfwrite
                                                                                                                                                                                                          • String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$_MEIPASS2$malloc
                                                                                                                                                                                                          • API String ID: 1635854594-2461342963
                                                                                                                                                                                                          • Opcode ID: ca8c180e82fc02696001b4b772ca5b4f9595369572e3e3818e5851be8c36e41a
                                                                                                                                                                                                          • Instruction ID: dedc42404c983bce25259a1f689a528bbd32b3ea96a0acd360ce2955a4666e2d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ca8c180e82fc02696001b4b772ca5b4f9595369572e3e3818e5851be8c36e41a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A28195A6A0C69181E720CB26E4A03AA63B0FFC47A4F984172DEDDA77D5DE7CD485C700
                                                                                                                                                                                                          Function 00007FF654CA8440 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                          • API String ID: 1339360106-2855260032
                                                                                                                                                                                                          • Opcode ID: fe406d8fb547cea20d7bfb8102cc3596c6133abc484eadb2eb76a5d76b1726db
                                                                                                                                                                                                          • Instruction ID: 6feeda8b429cc0ac5ab239d524766e68f7f5bd45a70907752286bcdf451545fb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe406d8fb547cea20d7bfb8102cc3596c6133abc484eadb2eb76a5d76b1726db
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD318FA160864242E7109B52B8A47AA7371AFC5BA4F584276EE6DA3BD4DF3CD405C700
                                                                                                                                                                                                          Function 00007FF654CAE5E0 Relevance: 25.9, APIs: 17, Instructions: 353COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 153 7ff654cae5e0-7ff654cae60d call 7ff654cb8578 156 7ff654cae61f-7ff654cae638 setlocale 153->156 157 7ff654cae60f-7ff654cae61b _strdup 153->157 158 7ff654cae63e-7ff654cae647 156->158 159 7ff654caea6b-7ff654caeae1 wcstombs realloc wcstombs setlocale free 156->159 157->156 158->159 160 7ff654cae64d-7ff654cae6f2 mbstowcs call 7ff654cae230 mbstowcs 158->160 161 7ff654caeae8-7ff654caeaf4 159->161 164 7ff654cae6f4-7ff654cae6ff 160->164 165 7ff654cae75b-7ff654cae760 160->165 168 7ff654cae701-7ff654cae70c 164->168 169 7ff654cae70e-7ff654cae723 164->169 166 7ff654cae762-7ff654cae771 165->166 167 7ff654cae77b-7ff654cae785 165->167 166->167 170 7ff654cae773-7ff654cae778 166->170 171 7ff654caea61-7ff654caea64 167->171 172 7ff654cae78b-7ff654cae79b 167->172 168->165 168->169 173 7ff654cae725-7ff654cae733 169->173 174 7ff654cae77a 169->174 170->167 171->159 175 7ff654cae7f1-7ff654cae7fb 172->175 173->174 176 7ff654cae735-7ff654cae756 setlocale free 173->176 174->167 177 7ff654cae79d-7ff654cae7a8 175->177 178 7ff654cae7fd 175->178 179 7ff654caea66-7ff654caea69 176->179 181 7ff654cae7be-7ff654cae7c9 177->181 182 7ff654cae7aa-7ff654cae7b5 177->182 180 7ff654cae800-7ff654cae808 178->180 179->161 183 7ff654cae80f-7ff654cae81c 180->183 184 7ff654cae80a-7ff654cae9b3 180->184 187 7ff654cae7b9 181->187 188 7ff654cae7cb-7ff654cae7d6 181->188 185 7ff654cae7b7 182->185 186 7ff654cae7ec 182->186 190 7ff654cae81e-7ff654cae829 183->190 191 7ff654cae838-7ff654cae840 183->191 198 7ff654cae9b5-7ff654cae9c0 184->198 199 7ff654cae9c2-7ff654cae9c7 184->199 185->181 186->175 187->181 188->187 192 7ff654cae7d8-7ff654cae7e2 188->192 190->183 193 7ff654cae82b-7ff654cae836 190->193 194 7ff654cae842-7ff654cae84d 191->194 195 7ff654cae89a-7ff654cae8b0 191->195 196 7ff654cae7ff 192->196 197 7ff654cae7e4-7ff654cae7e8 192->197 193->183 193->191 202 7ff654cae84f-7ff654cae85a 194->202 203 7ff654cae85c-7ff654cae871 194->203 204 7ff654cae8b7-7ff654cae8c2 195->204 196->180 197->186 198->199 200 7ff654cae9c9-7ff654cae9d5 198->200 201 7ff654cae9da-7ff654caea39 wcstombs realloc wcstombs 199->201 200->201 207 7ff654caea3e-7ff654caea5f setlocale free 201->207 202->195 202->203 203->195 208 7ff654cae873-7ff654cae882 203->208 205 7ff654cae8c4-7ff654cae8cf 204->205 206 7ff654cae8b2 204->206 205->206 209 7ff654cae8d1-7ff654cae8dd 205->209 206->204 207->179 208->195 210 7ff654cae884-7ff654cae893 208->210 211 7ff654cae8df-7ff654cae8f1 209->211 212 7ff654cae8f3-7ff654cae8f7 209->212 210->195 213 7ff654cae895 210->213 211->212 214 7ff654cae8fb-7ff654cae903 211->214 212->214 213->195 215 7ff654cae95a-7ff654cae964 214->215 216 7ff654cae905-7ff654cae922 215->216 217 7ff654cae966-7ff654cae98f wcstombs 215->217 218 7ff654cae940-7ff654cae94b 216->218 219 7ff654cae924-7ff654cae937 216->219 217->207 220 7ff654cae995-7ff654cae9a3 217->220 222 7ff654cae94d-7ff654cae958 218->222 223 7ff654cae93b 218->223 219->215 221 7ff654cae939 219->221 220->207 221->218 222->215 222->223 223->218
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 918573998-0
                                                                                                                                                                                                          • Opcode ID: a83cf2a6e7cdc1dd5fd551beaeb6a114339be945ac12246f5548f53177ceeab4
                                                                                                                                                                                                          • Instruction ID: f4cd77e1830dbf52755837107e1a0d5ee60df2f5d932de03dbce69b9c962df6c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a83cf2a6e7cdc1dd5fd551beaeb6a114339be945ac12246f5548f53177ceeab4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9CF140A6F04B1588FB509BAAC4912BC37B0FB85B88F884476DE4CA7799DF38D451C360
                                                                                                                                                                                                          Function 00007FF654CA1E80 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 144COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freadmalloc$fcloseferrorfree
                                                                                                                                                                                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 1320676746-1463511288
                                                                                                                                                                                                          • Opcode ID: e3634c2f215a7801dd9328adda742cb27553f91e41f206a36010a9a902b352bd
                                                                                                                                                                                                          • Instruction ID: babdc14d796f17458553065fe2034b09e9d09d4541117d9d885cdfc4dc8efd52
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e3634c2f215a7801dd9328adda742cb27553f91e41f206a36010a9a902b352bd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91514DB2B0961296EA18CB16D5E027967B1BFC8744F888077DA0E97B95DF3DE4A1C700
                                                                                                                                                                                                          Function 00007FF654CA79C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                          • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                          • API String ID: 1833775142-3524285272
                                                                                                                                                                                                          • Opcode ID: 8ef660b42063669becf1bd41f8a29df173ea005990595a1a776f16ce8dcaa147
                                                                                                                                                                                                          • Instruction ID: 987aecc7d3df137f483188ecc238f26ea64b04d5271b215a9f71ed6878d3b341
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ef660b42063669becf1bd41f8a29df173ea005990595a1a776f16ce8dcaa147
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2415072A0878285EB209B65F8A43EA7370FBC5794F484136DA8D97795DF7CD088CB40
                                                                                                                                                                                                          Function 00007FF654CA16D0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 285stringCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 278 7ff654ca16d0-7ff654ca3b83 call 7ff654ca8160 call 7ff654cae230 call 7ff654ca21b0 286 7ff654ca3b89-7ff654ca3b9c call 7ff654ca42f0 278->286 287 7ff654ca3f38 278->287 286->287 291 7ff654ca3ba2-7ff654ca3bb7 call 7ff654ca4380 286->291 290 7ff654ca3f40-7ff654ca3f4f call 7ff654ca5ee0 287->290 296 7ff654ca3f5f-7ff654ca3f73 call 7ff654ca6310 call 7ff654ca61b0 290->296 297 7ff654ca3f51-7ff654ca3f5d call 7ff654ca6100 290->297 291->287 299 7ff654ca3bbd-7ff654ca3bd2 call 7ff654ca4370 291->299 312 7ff654ca3f80-7ff654ca3f90 call 7ff654ca20b0 296->312 297->296 304 7ff654ca3fd8-7ff654ca3fe5 call 7ff654ca6430 297->304 299->287 309 7ff654ca3bd8-7ff654ca3bed call 7ff654ca6fe0 299->309 314 7ff654ca3fea-7ff654ca3ff5 fclose 304->314 316 7ff654ca3d50-7ff654ca3d61 call 7ff654ca70d0 call 7ff654ca20b0 309->316 317 7ff654ca3bf3-7ff654ca3c0d call 7ff654ca6fe0 309->317 323 7ff654ca3c56-7ff654ca3c8a call 7ff654ca8210 312->323 324 7ff654ca3f96 312->324 319 7ff654ca3fa6-7ff654ca3fb5 call 7ff654ca2cd0 314->319 335 7ff654ca3d66-7ff654ca3d68 316->335 331 7ff654ca3c0f-7ff654ca3c15 317->331 332 7ff654ca3c38-7ff654ca3c50 call 7ff654ca70d0 call 7ff654ca20b0 317->332 319->287 343 7ff654ca3c90-7ff654ca3ca9 SetDllDirectoryW call 7ff654ca6170 323->343 344 7ff654ca3ff7-7ff654ca4003 call 7ff654ca2cd0 323->344 329 7ff654ca3f26-7ff654ca3f33 call 7ff654ca2cd0 324->329 329->287 333 7ff654ca3f00 331->333 334 7ff654ca3c1b-7ff654ca3c33 free call 7ff654ca70d0 331->334 332->312 332->323 341 7ff654ca3f10-7ff654ca3f20 call 7ff654ca20b0 333->341 334->332 340 7ff654ca3d6e-7ff654ca3d8e call 7ff654ca3520 335->340 335->341 356 7ff654ca3e3e call 7ff654ca6170 340->356 357 7ff654ca3d94-7ff654ca3d99 340->357 341->329 355 7ff654ca3da8-7ff654ca3dbd call 7ff654ca43b0 341->355 358 7ff654ca3caf-7ff654ca3cb4 call 7ff654ca61b0 343->358 359 7ff654ca3e48-7ff654ca3e58 call 7ff654ca5cc0 343->359 344->287 371 7ff654ca3fa0 355->371 372 7ff654ca3dc3-7ff654ca3e10 call 7ff654ca7d30 355->372 364 7ff654ca3e43 356->364 357->355 367 7ff654ca3cb9-7ff654ca3cc6 strcmp 358->367 359->290 370 7ff654ca3e5e-7ff654ca3e6b call 7ff654ca61b0 359->370 364->359 368 7ff654ca3cc8-7ff654ca3ceb call 7ff654ca3b20 367->368 369 7ff654ca3d0a-7ff654ca3d33 call 7ff654ca3a90 call 7ff654ca3aa0 call 7ff654ca3b00 call 7ff654ca6310 call 7ff654ca61b0 367->369 368->287 381 7ff654ca3cf1-7ff654ca3d05 strcpy 368->381 401 7ff654ca3d38-7ff654ca3d4d 369->401 370->367 383 7ff654ca3e71-7ff654ca3e80 call 7ff654ca3580 370->383 371->319 372->314 384 7ff654ca3e16-7ff654ca3e38 call 7ff654ca3520 372->384 381->369 383->287 392 7ff654ca3e86-7ff654ca3e90 383->392 384->356 384->357 394 7ff654ca3e92 392->394 395 7ff654ca3e99-7ff654ca3eac call 7ff654ca7070 call 7ff654ca79b0 392->395 394->395 395->287 403 7ff654ca3eb2-7ff654ca3ee5 call 7ff654ca3b10 call 7ff654ca79c0 call 7ff654ca6310 call 7ff654ca61b0 395->403 412 7ff654ca3fc0-7ff654ca3fc7 call 7ff654ca7490 403->412 413 7ff654ca3eeb-7ff654ca3ef3 call 7ff654ca21f0 403->413 416 7ff654ca3fcc 412->416 413->401 416->413
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$EnvironmentVariable$DirectoryFileModuleNamecallocstrcmpstrcpy
                                                                                                                                                                                                          • String ID: Cannot side-load external archive %s (code %d)!$Error opening archive ZNdewcHn8K from executable (%s) or external archive (%s)$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                          • API String ID: 4056350997-3668766296
                                                                                                                                                                                                          • Opcode ID: 8037da94f03f8b8fec9e8aa24b1861a1d75888de2a0157cbc5161594d342ec19
                                                                                                                                                                                                          • Instruction ID: 723f92a87f2936aa3c76af61cbceb6ba315cc9e1c360b81ee62241ca0de7e46b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8037da94f03f8b8fec9e8aa24b1861a1d75888de2a0157cbc5161594d342ec19
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98C1A6A1A1D64250FA10DB2398B01BA6674AFC4BC4F4C40B3EE4EE7BE6DE3CE5458700
                                                                                                                                                                                                          Function 00007FF654CA7490 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
                                                                                                                                                                                                          • String ID: _MEIPASS2
                                                                                                                                                                                                          • API String ID: 3789554339-3944641314
                                                                                                                                                                                                          • Opcode ID: 3889d0a8454738bdc02ac1a27fcd313a3c6fda00dcb1aeb9c18716f4fec953fa
                                                                                                                                                                                                          • Instruction ID: beaedefb14458b0954ffeb20603008eba5b88a3865c958cf3aaa40ff8adcf9fd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3889d0a8454738bdc02ac1a27fcd313a3c6fda00dcb1aeb9c18716f4fec953fa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3521D0D2B4954244EA10A613A8A46BA52B2BFC5BE0FCC85B3ED1DA77C6ED3CD4458314
                                                                                                                                                                                                          Function 00007FF654CA76B0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 102stringCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$ByteCharMultiWidefreememsetstrcpystrtok
                                                                                                                                                                                                          • String ID: WARNING: file already exists but should not: %s
                                                                                                                                                                                                          • API String ID: 901113649-146164175
                                                                                                                                                                                                          • Opcode ID: 22a9787840595a1d560ab590334c00c77606adf5d77760e485accf00cc5aaf83
                                                                                                                                                                                                          • Instruction ID: f7f63d71ed15e4af07ef2cc17e75bf3c3cc54be8e5d1a378b3937fb2516d657b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 22a9787840595a1d560ab590334c00c77606adf5d77760e485accf00cc5aaf83
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA31A091B4954244FA21E713E8A57FA52626FC5BC4F8C40B3ED0DE77C6DE2CE149C650
                                                                                                                                                                                                          Function 00007FF654CA75D0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcscatwcscmp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3846154227-0
                                                                                                                                                                                                          • Opcode ID: d9fc9803e7bfdff9322b61788698340c51d4f1b4d93720d135f91fe10f214957
                                                                                                                                                                                                          • Instruction ID: dc6887e6ccc5f1225daad81d0523fa5e873dcda5db4dd2fa1c2f15dd1e19a61b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d9fc9803e7bfdff9322b61788698340c51d4f1b4d93720d135f91fe10f214957
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4116DD0B8D54345FA59AB2798B43B912B16FC4BC4F4C80B3DD0EE6282EE2CE5068224
                                                                                                                                                                                                          Function 00007FF654CA86B0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: mallocmemcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4276657696-0
                                                                                                                                                                                                          • Opcode ID: 61eaa1ab35641a1ad6f539a3031d6a572ba3cd1bcdd971e16e585366fc5a0095
                                                                                                                                                                                                          • Instruction ID: a40ddd9499e9f0b48b1ab8b457dfb608d0f8a8bd7d3bcf7594292a81887e1267
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61eaa1ab35641a1ad6f539a3031d6a572ba3cd1bcdd971e16e585366fc5a0095
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A231AEB6B255418BE660CA27E49466AB6B1FB84B80F185035DB4AD7B40EE3CF880CB00
                                                                                                                                                                                                          Function 00007FF654CA7D30 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freemalloc
                                                                                                                                                                                                          • String ID: _MEIPASS2
                                                                                                                                                                                                          • API String ID: 3061335427-3944641314
                                                                                                                                                                                                          • Opcode ID: da46ef3b5912aebcfa8d404ac62b0d1d0bad185323e599ae2328ef0c0b4c6286
                                                                                                                                                                                                          • Instruction ID: 5b0c06c5fc477e7d01a1bfbc06f031b5b856a8db3b8c6ecb1eb4e27287fd294e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: da46ef3b5912aebcfa8d404ac62b0d1d0bad185323e599ae2328ef0c0b4c6286
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 412108A2B0A11205FE10951399A47FAD6667F85BC4F8C0473DE0DEB7C1ED3CE942C240
                                                                                                                                                                                                          Function 00007FF654CA6170 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 894 7ff654ca6170-7ff654ca6186 calloc 895 7ff654ca6188-7ff654ca618c 894->895 896 7ff654ca618d-7ff654ca61aa call 7ff654ca2e50 894->896 896->895
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: calloc
                                                                                                                                                                                                          • String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                          • API String ID: 2635317215-799113134
                                                                                                                                                                                                          • Opcode ID: daeeb61d3e57278251d27ce958a3713753ff428d5e00cabe7585f6002fde9d4c
                                                                                                                                                                                                          • Instruction ID: 14d1bdee05f23941bb96d06a4412261f5947c08b2419bf668f690ed2517d87c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: daeeb61d3e57278251d27ce958a3713753ff428d5e00cabe7585f6002fde9d4c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6E0C2E1F0860680EA14AB00D4E91F92B70EFC4340FCC40B6DA5CB7BA2EE3CE5458700
                                                                                                                                                                                                          Function 00007FF654CAF300 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fsetpos
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 850078086-0
                                                                                                                                                                                                          • Opcode ID: 1b41710901f17b2eeca1497c090281577d230925116f41a5d4b4f06b87e02d06
                                                                                                                                                                                                          • Instruction ID: b104fdc5b6c141cf6f9acb5d5b09d47a2712c4bd0829fc231079b8ff7df6f3fc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b41710901f17b2eeca1497c090281577d230925116f41a5d4b4f06b87e02d06
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51114DB6A05B06C9EB10DF66C4A10BC33B0AF84798F544AB6EA1DA7799DF38D0508360
                                                                                                                                                                                                          Function 00007FF654CA20B0 Relevance: 3.0, APIs: 2, Instructions: 48stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosestrcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3396940900-0
                                                                                                                                                                                                          • Opcode ID: 971efec496ac2d361f2b672ee238c628acabd71029eeb8cfc9f8320c43482ae7
                                                                                                                                                                                                          • Instruction ID: 3796415255b77e960a134fc900405ab017e41298186196f1cfaf81f32bc4ce62
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 971efec496ac2d361f2b672ee238c628acabd71029eeb8cfc9f8320c43482ae7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0118EA5B0814280FB549A72E9A53F912619FD4BC4F9C8173DD0EE778ADE2CE8C9C310
                                                                                                                                                                                                          Function 00007FF654CAF1BB Relevance: 2.6, APIs: 2, Instructions: 67COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freememsetwcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2332356550-0
                                                                                                                                                                                                          • Opcode ID: 16ca566369b86500749d9f98ec16c1cf0d74b93f9dbbc66e3a29c3db3259c6e1
                                                                                                                                                                                                          • Instruction ID: 00bee5ed386922b5bf0a7c5e12d49da0a74c4ced8ab3b4f24a2bb71e0cfb6ff3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16ca566369b86500749d9f98ec16c1cf0d74b93f9dbbc66e3a29c3db3259c6e1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2231EAA6F00B1489EB10CF7AD48109C3BB1FB98BA8B148566EE1C53B6CDF34C591C790
                                                                                                                                                                                                          Function 00007FF654CAEE10 Relevance: 2.5, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpymemset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1297977491-0
                                                                                                                                                                                                          • Opcode ID: 28245664c572555644c21b5e65988328f64a065fd9a3e6ebb93e0ea27bb1dba2
                                                                                                                                                                                                          • Instruction ID: a757d76789d26065d29f647b99451c2c7016f4da10d737462df58c0f5c0fc47a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 28245664c572555644c21b5e65988328f64a065fd9a3e6ebb93e0ea27bb1dba2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3721E876B40B8689DB70CF6AD8843ED33B1EB49BA8F514266CE3C5BB98DE34C5408340
                                                                                                                                                                                                          Function 00007FF654CAEEF0 Relevance: 2.5, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpymemset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1297977491-0
                                                                                                                                                                                                          • Opcode ID: 3e7cd3d59118b199465456136e8bc5aa6b3bf50dbcff2041c2c4c44bafb46f53
                                                                                                                                                                                                          • Instruction ID: 745c858ff35faf353da0d1162648ca15ea873b2c068f9e624094dbb401a66716
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3e7cd3d59118b199465456136e8bc5aa6b3bf50dbcff2041c2c4c44bafb46f53
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8321E576B40B8689DB20CF6AD8843ED37B1EB49B98F518166CE2C5BB98DE34C6448740
                                                                                                                                                                                                          Function 00007FF654CA43B0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • _wfopen.MSVCRT ref: 00007FF654CA43F5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 372205238-0
                                                                                                                                                                                                          • Opcode ID: e249028c2137e21c272be09ebad8c35b62695eafe249120916a556fd3ad7a81d
                                                                                                                                                                                                          • Instruction ID: ce7b9c4f3f1a137ca05e3566820a6583da373b9eeb85fd7be1711753db72d2db
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e249028c2137e21c272be09ebad8c35b62695eafe249120916a556fd3ad7a81d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9E0D8D1B4C21102F9146213BD647FA92225F8AFC4F488132EF0CABB8A8D1DD243CB00
                                                                                                                                                                                                          Function 00007FF654CA9330 Relevance: 1.4, APIs: 1, Instructions: 135COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3510742995-0
                                                                                                                                                                                                          • Opcode ID: 8ecaa912455c69dac76f6531f9098773f1cfe53416ab283d50a917500fe93d8f
                                                                                                                                                                                                          • Instruction ID: 4661e98657bf537db85acc512dec81c563c70da0efd4cdcba8dd89635027c305
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ecaa912455c69dac76f6531f9098773f1cfe53416ab283d50a917500fe93d8f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4751B377A182528BE7608E26E098A2F77F4FF847D4F198476DA4697A84CF38D844CB00
                                                                                                                                                                                                          Function 00007FF654CACBA0 Relevance: 1.3, APIs: 1, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2221118986-0
                                                                                                                                                                                                          • Opcode ID: 623919cd236f253b3d7bc4f578d470e9102edac5acaca204977424f4e3dbef8b
                                                                                                                                                                                                          • Instruction ID: 574f1b3ce3b82e9b44adfb3d838f31a46a3e68b46195a73d1774baacd5146e6e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 623919cd236f253b3d7bc4f578d470e9102edac5acaca204977424f4e3dbef8b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E315DA6F0471599F7109BA6D4903BC37B0AB80B88F9840B6DE4CA7B98DF3CD691C750
                                                                                                                                                                                                          Function 00007FF654CA8AE0 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2803490479-0
                                                                                                                                                                                                          • Opcode ID: 0fc86e8ee51b5bdc1f5f7082c9320d3be715a44251d05dfd6912ed91f5c13a9f
                                                                                                                                                                                                          • Instruction ID: 9ced9d583d56a81cae4a990e0d4cd5c51dcbbd51bab2b6840cf302b74af97891
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fc86e8ee51b5bdc1f5f7082c9320d3be715a44251d05dfd6912ed91f5c13a9f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 722162A2A09A0247EB658B5694A033936A1AFC4B94F6D4176C91DA77D0DF39DC83C350

                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                          Function 00007FF654CA4410 Relevance: 291.1, APIs: 55, Strings: 111, Instructions: 566libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc
                                                                                                                                                                                                          • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                                          • API String ID: 190572456-3109299426
                                                                                                                                                                                                          • Opcode ID: 4916de274225d75524e548f11a2fa4b69452b516a84e6ab57919398c0b26c71a
                                                                                                                                                                                                          • Instruction ID: 82984f45b2155a2aa39184cfb74638ee80bfdb5d574a0626826153511e8dae7a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4916de274225d75524e548f11a2fa4b69452b516a84e6ab57919398c0b26c71a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E52A0E0E1DA0791EA49DB16FAF00B42275AFC4381B8C91F3C45EA27A2EF6CE545D315
                                                                                                                                                                                                          Function 00007FF654CA2560 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                          • String ID: $BUTTON$Close$EDIT$Failed to vqmkBiYr script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                          • API String ID: 3223904152-2049099994
                                                                                                                                                                                                          • Opcode ID: f946fc37740113d1f7e6e8a1de48a3746edf2e82bfe78e13903bb1f18fd90df2
                                                                                                                                                                                                          • Instruction ID: 709febca6ca9bb1fff722a10e6abc08a1bf68adee4d3bfccb26f7a8030932bae
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f946fc37740113d1f7e6e8a1de48a3746edf2e82bfe78e13903bb1f18fd90df2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB91BD76218B9082E7108F61E4A479A7770F788BC8F14413AEE8C5BB98CF7EC085CB50
                                                                                                                                                                                                          Function 00007FF654CA7E50 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                          • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                          • API String ID: 1653872744-2573406579
                                                                                                                                                                                                          • Opcode ID: cbdb8eea67fde94177a7de486669295192c3b68fd3ad581342b718ce3b64fd12
                                                                                                                                                                                                          • Instruction ID: 17ace3ffe9bc72564030de6aadc604497a6a47deef951c714ff299baa734e2c8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbdb8eea67fde94177a7de486669295192c3b68fd3ad581342b718ce3b64fd12
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5021AEB1A18A4381F7609B15F8E07A62271AFC5394F8C41BAE94DA2AA4DF3CD589C700
                                                                                                                                                                                                          Function 00007FF654CA15E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                          • String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                          • API String ID: 384173800-1835852900
                                                                                                                                                                                                          • Opcode ID: e6b7f3097ed1fa55bbfab8c2ac934be5e0bcb191cc89f52011f527b87621e30f
                                                                                                                                                                                                          • Instruction ID: 1f0784ae3fc797d470a0edd04e01738fd937e673f3f285ace8211833898c514f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6b7f3097ed1fa55bbfab8c2ac934be5e0bcb191cc89f52011f527b87621e30f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B701BAA4A4AA5B91EA119B06F9A017423B4AF88794F8C41B3C84EE7364EF2CE546C300
                                                                                                                                                                                                          Function 00007FF654CB508A Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 1364COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: Infinity$NaN
                                                                                                                                                                                                          • API String ID: 0-4285296124
                                                                                                                                                                                                          • Opcode ID: ec4959e25b3a233c40df6fe2cbcd1797900df63c317f93c6ae3b59cfffbb73f8
                                                                                                                                                                                                          • Instruction ID: a0a86ad1bd87730252e6bb342f09852a2edcecc35cc192d76e1b530284448896
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ec4959e25b3a233c40df6fe2cbcd1797900df63c317f93c6ae3b59cfffbb73f8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 49E219B2A04B458EE751CF79C4942AC37B1FB8578CF548266EA0DA7B59DF38E481CB40
                                                                                                                                                                                                          Function 00007FF654CA9640 Relevance: 3.9, Strings: 3, Instructions: 138COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: incorrect header check$invalid window size$unknown compression method
                                                                                                                                                                                                          • API String ID: 0-1186847913
                                                                                                                                                                                                          • Opcode ID: d51e19eb2a5d66987ad539d3f96753dfa09b1ab6df977b44f91825f4f2a35776
                                                                                                                                                                                                          • Instruction ID: 2bfa163b76fa5cb7486f636007f5835faf6bf1e9c253d7819f77c368b2dd6b51
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d51e19eb2a5d66987ad539d3f96753dfa09b1ab6df977b44f91825f4f2a35776
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8951C4B2A186128BE7648E26D4EC57E36B5EF84344F19817ADB1AD7780DF3CE904DB04
                                                                                                                                                                                                          Function 00007FF654CA9660 Relevance: 1.5, APIs: 1, Instructions: 253COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3510742995-0
                                                                                                                                                                                                          • Opcode ID: ab0a6b18e32699958ec78ff02d5a0d2387750140b9c869829991cde5e5795802
                                                                                                                                                                                                          • Instruction ID: 76fef823cd1ffdd41cc5cb9dee76c7370260e906de2684464c63258a0e071735
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab0a6b18e32699958ec78ff02d5a0d2387750140b9c869829991cde5e5795802
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57B1B6B2E083514AE7618F16D0A9B3E7AB5EF85784F19457ADF499BB80DF39D800CB40
                                                                                                                                                                                                          Function 00007FF654CAB2A0 Relevance: .3, Instructions: 328COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 3db726857f4e012455a8f3608d8def5699ee7c479c0fb5f7e8890c9e2af20ea6
                                                                                                                                                                                                          • Instruction ID: 7c337a4640c50058c412664c0e0cd41d548537c4011215fc11084aeb874a98c2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3db726857f4e012455a8f3608d8def5699ee7c479c0fb5f7e8890c9e2af20ea6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5DD1D572A1C69286D7258F16E0A467E77B0FBC4744F484176EB8AA3B94EF3DD844CB00
                                                                                                                                                                                                          Function 00007FF654CABE20 Relevance: .3, Instructions: 281COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 58ac91676b8285db99ac092ed0f9aacb70baec7d96c70589df18768542e35690
                                                                                                                                                                                                          • Instruction ID: af845014eec887f8036c4e35a8988647dd551fd836ee2100f23940a745fecf55
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58ac91676b8285db99ac092ed0f9aacb70baec7d96c70589df18768542e35690
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 49A128B7B241A047EA50CB2AD46467A77B2F78A7D0F88D262DF8957788CA3DE415C700
                                                                                                                                                                                                          Function 00007FF654CA6100 Relevance: 166.6, APIs: 31, Strings: 64, Instructions: 348libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc$LibraryLoadfree
                                                                                                                                                                                                          • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                          • API String ID: 4213687213-1453502826
                                                                                                                                                                                                          • Opcode ID: 12046f0df8fa877728ee4941feaf5612ec9e4b955045cb1a8f9a13e301cd7c08
                                                                                                                                                                                                          • Instruction ID: 973cf5e1eb3db5a902a6e7c684a0dc43147a4d93fd2fd0fd87dbf93562d895e1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12046f0df8fa877728ee4941feaf5612ec9e4b955045cb1a8f9a13e301cd7c08
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0202E3E4E0AB0790EA55DB15F9F40B427B4AFC4380B8C94B7C44EA77A5EE6CE54AC310
                                                                                                                                                                                                          Function 00007FF654CA3680 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                          • API String ID: 1294909896-4198433784
                                                                                                                                                                                                          • Opcode ID: 3a04efc8f6b0c85cf8dfc67f3231cc18b95e8f3610fca39b876c7c2b14a4cb32
                                                                                                                                                                                                          • Instruction ID: a12c2918d72dbe00be560d38cb66e38bb3fa5c46d70aec42375497fa29625e06
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3a04efc8f6b0c85cf8dfc67f3231cc18b95e8f3610fca39b876c7c2b14a4cb32
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5B105A5A09A0A85EA04DB57E8B41792370BFC9FC5F8844B3DD1EA77B1EE3CE4059700
                                                                                                                                                                                                          Function 00007FF654CAE270 Relevance: 25.7, APIs: 17, Instructions: 223COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1093732947-0
                                                                                                                                                                                                          • Opcode ID: 18a3bf99bbea6804c92c0b9e4b21d59020ad17d25526b3b34f8233c8396aa3f0
                                                                                                                                                                                                          • Instruction ID: 48c3d16ae4a0d8245a67ff6491d3204a8a2541cc9008ad528d788b2e1e2ea89d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 18a3bf99bbea6804c92c0b9e4b21d59020ad17d25526b3b34f8233c8396aa3f0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22A140A6F05B5588FB409BA6D8902BD33B0BB85B88F844576DE4CA7799EF3CD4018360
                                                                                                                                                                                                          Function 00007FF654CA5550 Relevance: 25.6, APIs: 2, Strings: 15, Instructions: 140COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$EnvironmentVariable
                                                                                                                                                                                                          • String ID: %s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                                                                                                                                                                                          • API String ID: 471908985-2552457735
                                                                                                                                                                                                          • Opcode ID: c48456801aa9cd7d8cc58aca705c0cba2a25958533fc06219b0b3206e7b935ed
                                                                                                                                                                                                          • Instruction ID: c5265b3b3413d4e9f1c6cb2bef02cd0de2cf1d92495f50b3756175d3fd4c8a5b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c48456801aa9cd7d8cc58aca705c0cba2a25958533fc06219b0b3206e7b935ed
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3613EA5E19A1685FA149B12E8F42B92370AFC4B84F8C80B3D94EF77A5DF2CE545C704
                                                                                                                                                                                                          Function 00007FF654CA31B0 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 202stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA3140: strcpy.MSVCRT(?,?,_MEIPASS2,?,00007FF654CA362C), ref: 00007FF654CA3183
                                                                                                                                                                                                          • strcmp.MSVCRT ref: 00007FF654CA333C
                                                                                                                                                                                                          • strcmp.MSVCRT ref: 00007FF654CA335F
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fread.MSVCRT ref: 00007FF654CA78B1
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: ferror.MSVCRT ref: 00007FF654CA78C1
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: clearerr.MSVCRT(?,00000000,?,00007FF654CA3267,?,00000000,?,00000000,?,?,_MEIPASS2,?,00007FF654CA362C), ref: 00007FF654CA78CD
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fclose.MSVCRT ref: 00007FF654CA7909
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fclose.MSVCRT ref: 00007FF654CA7911
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosestrcmp$clearerrferrorfreadstrcpy
                                                                                                                                                                                                          • String ID: %s%s%s$%s%s%s%s%s$%s%s%s%s%s%s%s$%s%s%s.exe$%s%s%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Error copying %s$Error extracting %s$Error opening archive %s$_MEIPASS2$malloc
                                                                                                                                                                                                          • API String ID: 2929065527-1083822304
                                                                                                                                                                                                          • Opcode ID: 1bf022133e02d134ef5717c222b468332fb72b96faf3dfb86209f937b62aaa32
                                                                                                                                                                                                          • Instruction ID: c4b7c286565264d354afc042142f1fca079c9f0df6d692b30c39b3c4c317a512
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1bf022133e02d134ef5717c222b468332fb72b96faf3dfb86209f937b62aaa32
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 058143A1A08A4251FA109B66E8B41FA6674AFC47D4F4841B3EE4DE7BE6DE3CE545C300
                                                                                                                                                                                                          Function 00007FF654CA4FB0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 138stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: mbstowcsstrncmp
                                                                                                                                                                                                          • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$_MEIPASS2$pyi-
                                                                                                                                                                                                          • API String ID: 1807066385-1485234868
                                                                                                                                                                                                          • Opcode ID: 4cd6353d8287d9ebdc7f42e50edfcd29b2454bf44d82fac0beb1f5a7f2d26726
                                                                                                                                                                                                          • Instruction ID: 8896b3b46835a2ba052d1b17a90308db01e8038b6a0ce010468dfe7c4a314018
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4cd6353d8287d9ebdc7f42e50edfcd29b2454bf44d82fac0beb1f5a7f2d26726
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 855171A5A0860681FB149F27D8A43792371AFC5B80F8880B7CD1EA73E1DE3DE4419750
                                                                                                                                                                                                          Function 00007FF654CA7110 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF654CA714B
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA7156
                                                                                                                                                                                                          • _wfullpath.MSVCRT ref: 00007FF654CA717E
                                                                                                                                                                                                          • wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71AD
                                                                                                                                                                                                          • wcsncpy.MSVCRT ref: 00007FF654CA71DB
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71E5
                                                                                                                                                                                                          • wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71F0
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA7202
                                                                                                                                                                                                          • _wcsdup.MSVCRT ref: 00007FF654CA721B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF654CA7260
                                                                                                                                                                                                          • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF654CA7250
                                                                                                                                                                                                          • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF654CA7230
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                                                                                                                                                                                          • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                          • API String ID: 274989731-3498232454
                                                                                                                                                                                                          • Opcode ID: d414b3e691f8c4d26ce76b45fbcb3174c9ed9ce5588de55e0f29948b1c7c796a
                                                                                                                                                                                                          • Instruction ID: 74490da21c68abeb4f98825352fe761e65e5eb0397b104ffbe40d1d688640675
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d414b3e691f8c4d26ce76b45fbcb3174c9ed9ce5588de55e0f29948b1c7c796a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B531F791B4D64285FA65A76698B43FA11A26FC8BC1FCC4476DE0EFB7C5ED2CE0458310
                                                                                                                                                                                                          Function 00007FF654CA1AF0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 103COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosefreadfreemalloc
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 3295367466-3659356012
                                                                                                                                                                                                          • Opcode ID: 17395cb0609f390432f450284fee7c978720a2aa7aeaa7cb82b717c276d2117a
                                                                                                                                                                                                          • Instruction ID: 572f06128dd524eefc0dfb7737fbcec5e7b6fca825b2bf5b9956e42b6949d000
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 17395cb0609f390432f450284fee7c978720a2aa7aeaa7cb82b717c276d2117a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4031CEE2B0965655FB059B12E8B06BA2374AF847D8FCC40B3DD0DA6791EE3CE549C300
                                                                                                                                                                                                          Function 00007FF654CA5410 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$setlocale$_strdupcalloc
                                                                                                                                                                                                          • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                                                                                                                                                                                          • API String ID: 3058678114-3355598041
                                                                                                                                                                                                          • Opcode ID: b3a94ae4ac6b4f6312338ae72a3d926f4a238985db292fd2604171276d9b9414
                                                                                                                                                                                                          • Instruction ID: b37cbe9adbc706a66e8b13a9d33bc4c771da5d6c849319b5a869130fa528bd46
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3a94ae4ac6b4f6312338ae72a3d926f4a238985db292fd2604171276d9b9414
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F21C192B0961251FA15E716D8B13BD6661AFC4B84FCCC4B6DD4EAB782EE3CE8458310
                                                                                                                                                                                                          Function 00007FF654CA29E0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$_wcsdup$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                          • API String ID: 2803985813-2699770090
                                                                                                                                                                                                          • Opcode ID: f526219bed773062a0d0eb333ccd5c88dea8aa0be73e6a7d34a87cd471690584
                                                                                                                                                                                                          • Instruction ID: f65e00833b24fff55ad8e33450edaa6d9902ffb8a622caae0893211575ac7eb8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f526219bed773062a0d0eb333ccd5c88dea8aa0be73e6a7d34a87cd471690584
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48218171A09A8281EA25DB52F8A46FA7370BFC5B80F884076EE4EA3B45DE3CD0458710
                                                                                                                                                                                                          Function 00007FF654CA5EE0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlenstrncpy$callocfreememcpy
                                                                                                                                                                                                          • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
                                                                                                                                                                                                          • API String ID: 4189425833-927121926
                                                                                                                                                                                                          • Opcode ID: e6d1f26a4508f2d6b54d28664a714fd9177c36a59f672facb49a808df95541a7
                                                                                                                                                                                                          • Instruction ID: 3838584349d1490d4bcda8e338be0a0421b1023dce89942d3d894a3b134a78bb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6d1f26a4508f2d6b54d28664a714fd9177c36a59f672facb49a808df95541a7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FD41F69170865255EA14EA23D8A47FA6374BFC4BC4F8C81B2EE1DA7786DE3CE145C314
                                                                                                                                                                                                          Function 00007FF654CA2350 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                          • Opcode ID: fea85488d9d1cac119e4a29d1ca9f633e5fae16107e641c76dad77d3c19cf46f
                                                                                                                                                                                                          • Instruction ID: 5a3431e8b08e52a4e24999c880935af3c735b4784b6e8aa00516d9c09925fbb2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fea85488d9d1cac119e4a29d1ca9f633e5fae16107e641c76dad77d3c19cf46f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F44187762156A18AD7208F36E44877977B1F788F99F084232EE8987B58DF3CD185CB20
                                                                                                                                                                                                          Function 00007FF654CA5CC0 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 124stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$mallocstrncpy$callocfreestrlenstrncat
                                                                                                                                                                                                          • String ID: Cannot allocate memory for necessary files.$_MEIPASS2
                                                                                                                                                                                                          • API String ID: 257583877-1389504347
                                                                                                                                                                                                          • Opcode ID: 3bb8c8111f3117a67a20ab620bc2b59a0c8817dcbebb759f212a3c23a2c28dbc
                                                                                                                                                                                                          • Instruction ID: 8d1787d98f764d605fcd2b9c2f1131e514017fab3f9d5bc73a880ffff7624449
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3bb8c8111f3117a67a20ab620bc2b59a0c8817dcbebb759f212a3c23a2c28dbc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0241E3B2B0524146EA28DA22D5A42ED7772BF847D0F888472CF1EA37C5EE7CE5458310
                                                                                                                                                                                                          Function 00007FF654CA7840 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclose$strlen$clearerrferror$_wfopenfreadfwritestrcpystrtok
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4076046571-0
                                                                                                                                                                                                          • Opcode ID: 66eaf6115f00770fdaf54dc94ed29b1f7162dcf97e56a77bd725569914621a69
                                                                                                                                                                                                          • Instruction ID: fdf851524041cf60aa971b2870663fcfe0cc434886bc99e8c92c91708060d421
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66eaf6115f00770fdaf54dc94ed29b1f7162dcf97e56a77bd725569914621a69
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE214C91F0E25301F815A6639AB13B952A61FC6BE4F4C01B3ED0EFB7C6EE1CE8014691
                                                                                                                                                                                                          Function 00007FF654CB207B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
                                                                                                                                                                                                          • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                          • API String ID: 1485978544-2115465065
                                                                                                                                                                                                          • Opcode ID: c93050da29d2b53cde75ff4ecec3a5117cbc28d906d175e1e5974c7ea21a5eeb
                                                                                                                                                                                                          • Instruction ID: cff94670349e4770835808b7bccbc8572527a6fc23849749fdb466b07f7ad649
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c93050da29d2b53cde75ff4ecec3a5117cbc28d906d175e1e5974c7ea21a5eeb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9810BB6A04B458AEB14CF6AC8942AC37F0F788B9CB458566EE5D97B58DF38D440CB40
                                                                                                                                                                                                          Function 00007FF654CA8040 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                          • API String ID: 1374691127-27947307
                                                                                                                                                                                                          • Opcode ID: ea88749d0a14f64099691da4aeb15603b84fc63f6c062682654e53545a88106d
                                                                                                                                                                                                          • Instruction ID: 580e308a626259bb97198b4daae4dde7f46a5b023a7520462a3ef9cc856cef53
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea88749d0a14f64099691da4aeb15603b84fc63f6c062682654e53545a88106d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D021A1A1A18B4285FA14DB66E8F037662B0AFC4394F8C8177DA4EAAAD1DF7CD044C310
                                                                                                                                                                                                          Function 00007FF654CA7F50 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                          • API String ID: 1374691127-3831141058
                                                                                                                                                                                                          • Opcode ID: c974b491895e7bda57dd440c625f49c5a3727ada228be6d7fc02953d331cde25
                                                                                                                                                                                                          • Instruction ID: 4465dabc60b6ba3ba377ccd988cd8adaf7ff57e94bdfe8c70497c4725ac4c57d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c974b491895e7bda57dd440c625f49c5a3727ada228be6d7fc02953d331cde25
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D21D1A1A1C74245E7509B56E8F036666B1EFC4394F88417BE94EB66D5DF7CD104C300
                                                                                                                                                                                                          Function 00007FF654CA7B70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                          • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                          • API String ID: 4278403329-2782260415
                                                                                                                                                                                                          • Opcode ID: 945d6d8d56f37cfe0361321e39814a85846aa9c2cc1a836560a03a797768b115
                                                                                                                                                                                                          • Instruction ID: 47778568f69772fe3bc2d4f5ee564081688bd911694d37ab6ce697b9a629c490
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 945d6d8d56f37cfe0361321e39814a85846aa9c2cc1a836560a03a797768b115
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F111DFE1A1A64285F7119B52E8F01B97671BFC4740F9C41BACD0DA33A1EE3CE484C300
                                                                                                                                                                                                          Function 00007FF654CA8210 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: %s%s: %s$Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                          • API String ID: 1374691127-2292745976
                                                                                                                                                                                                          • Opcode ID: e25d75c4397cd3946ce71200e75b93b7a887f4a347cf1552ce9ec0bda547e504
                                                                                                                                                                                                          • Instruction ID: 1a86a265c6b070f7596c4c3ecf98d12c87cc4de1c4d3bd552fcbcb96baa33454
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e25d75c4397cd3946ce71200e75b93b7a887f4a347cf1552ce9ec0bda547e504
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B1193E1F09A4245FA24DB66E8B02B522B19FC8798F8C4277D94DA76D1EE3CE045C320
                                                                                                                                                                                                          Function 00007FF654CA57D0 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 84stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freestrlen
                                                                                                                                                                                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
                                                                                                                                                                                                          • API String ID: 322734593-568040347
                                                                                                                                                                                                          • Opcode ID: 6d413cf45324b08ffd4bc974ac5a2fa952e0ec21fb8adde832674f877a8c338b
                                                                                                                                                                                                          • Instruction ID: e9478405bfe89d8356fdc044c51e20c3a9de5755dfd6bc7600f40dbc39bedd85
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d413cf45324b08ffd4bc974ac5a2fa952e0ec21fb8adde832674f877a8c338b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9316EA1B09A4691EA149B57E8A40B96330BFC4B94F8C84B3DD1EE77A1EE3CE445D301
                                                                                                                                                                                                          Function 00007FF654CA6520 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 157COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                          • API String ID: 1294909896-1126984729
                                                                                                                                                                                                          • Opcode ID: f715ec876722e12cdb0f662df770872b06380997f3a1ed7aba2766a90e7ae60b
                                                                                                                                                                                                          • Instruction ID: 9643b123931b93ecfc1a13828861565f0810a3f814ace5edbc3fe8db6b0e578e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f715ec876722e12cdb0f662df770872b06380997f3a1ed7aba2766a90e7ae60b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7071FAB6618A4695EB109F62E8A83693370FB88F85F488073DE5EA7364DF3CD509C740
                                                                                                                                                                                                          Function 00007FF654CA5910 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen
                                                                                                                                                                                                          • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                                                                                                                                                                                          • API String ID: 39653677-2762566162
                                                                                                                                                                                                          • Opcode ID: d933acb19d688c888bbabfb13c8229aa91e53fac741f948bdaf742cd5b545c31
                                                                                                                                                                                                          • Instruction ID: 257fbcc23c0b2da53f40a2928bfc369a0eb1dba8bb13b3ef2f7d882ebe2718e4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d933acb19d688c888bbabfb13c8229aa91e53fac741f948bdaf742cd5b545c31
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F11133A6E0991685FA00DB6AE8A40A96370AFC4FD4B8C8173DD1DE7761EE3CE546C700
                                                                                                                                                                                                          Function 00007FF654CB2378 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwprintf$fputwc
                                                                                                                                                                                                          • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                          • API String ID: 2988249585-4054516066
                                                                                                                                                                                                          • Opcode ID: b02ba0fa6d73b1136932df1615eabb89f2fc48cd2a4aa50ad3fcf4feca9b3b31
                                                                                                                                                                                                          • Instruction ID: 56f9b3c771380ba5e434f42c949319a640f5cf67ea75b5c02e06c19b2a15a7b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b02ba0fa6d73b1136932df1615eabb89f2fc48cd2a4aa50ad3fcf4feca9b3b31
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9671FCB6A04B89CADB24CF2AC4945AC77F0F788B9CB458566EE4D97B58DF38D400CB40
                                                                                                                                                                                                          Function 00007FF654CA6F10 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3157260142-0
                                                                                                                                                                                                          • Opcode ID: b55e16029522fecb1b93b6b8568f11f36e77bc886cc5cb275ce0ddd000ea1ea0
                                                                                                                                                                                                          • Instruction ID: 649894e7a07060035aba572be40f29fdaeebe30295591872a16ee8c8711d47b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b55e16029522fecb1b93b6b8568f11f36e77bc886cc5cb275ce0ddd000ea1ea0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4311C282B0A14208FC5AEA5359F47BB45A11FD5FD8D8C80B2ED4DAB781FE3CA4468360
                                                                                                                                                                                                          Function 00007FF654CA2920 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1200242243-0
                                                                                                                                                                                                          • Opcode ID: 89cb7d82cb1b40587ec4d78b90bde32f8ec055dd5bdbf5a296f83f89b3663874
                                                                                                                                                                                                          • Instruction ID: cc460658e1ce59e7c95f55528b7dd1d069b67309fb220763fa14eefccef88c29
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 89cb7d82cb1b40587ec4d78b90bde32f8ec055dd5bdbf5a296f83f89b3663874
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5901C0A0E1D17B42F65CA33778E56BC11B1AFD9B11F9C44B3D94FE5B988C2C68C24201
                                                                                                                                                                                                          Function 00007FF654CAD850 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: CCG
                                                                                                                                                                                                          • API String ID: 0-1584390748
                                                                                                                                                                                                          • Opcode ID: a2009b416c13826995d1c9318a92a1b9d2e4341e694bba52663129bfcb9c8ac9
                                                                                                                                                                                                          • Instruction ID: 26bed0aa39a31060e47e90cc69aba9865991b2ed665222cafed5457c9debdff5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2009b416c13826995d1c9318a92a1b9d2e4341e694bba52663129bfcb9c8ac9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 734175B6A096028AF7208B65C4E43BC3272EFC5718F188677CA2DE77D4DE3CD9419241
                                                                                                                                                                                                          Function 00007FF654CA2C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF654CA2C93
                                                                                                                                                                                                          • MessageBoxA.USER32 ref: 00007FF654CA2CBB
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                          • String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
                                                                                                                                                                                                          • API String ID: 1878133881-785100509
                                                                                                                                                                                                          • Opcode ID: f8b2052244f997f8cf142d2b4763022da063b563fc09b0a30e2edc3fc9052039
                                                                                                                                                                                                          • Instruction ID: 7dc9d71577be989c89177034a91cf21993150ee6a6a911859f43416f3186c8a1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8b2052244f997f8cf142d2b4763022da063b563fc09b0a30e2edc3fc9052039
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0801F5B279879041FB345B62B8547FA6290BB89FD8F888035CE4D67B85CD3DD5858B40
                                                                                                                                                                                                          Function 00007FF654CA42F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                          • API String ID: 1532159127-1977442011
                                                                                                                                                                                                          • Opcode ID: f4bf1276b97d64210b6653597ec094bb76e5d053494305fba7f19c3c38b4cda7
                                                                                                                                                                                                          • Instruction ID: e4688c0613782778e6b8853051936c5d7a0aef4b84b9e59e4f6a74800fa88d29
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4bf1276b97d64210b6653597ec094bb76e5d053494305fba7f19c3c38b4cda7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53F0AFD1B1C15392FA556622A8B53F902B1AFC47C4F8C40B3D84EE67C6DD0EE5469310
                                                                                                                                                                                                          Function 00007FF654CA2B10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                          • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                          • API String ID: 3219091393-982972847
                                                                                                                                                                                                          • Opcode ID: 8df6a8358dac60a212556b377cd368c0f9cc8a804325971415c7063dd2af1f98
                                                                                                                                                                                                          • Instruction ID: 45b0259018f5ba383fbd1b91b62b7673d542c93eb8ca9fedd33e035a73825927
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8df6a8358dac60a212556b377cd368c0f9cc8a804325971415c7063dd2af1f98
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51017191B5966206FD1DA5A719B2AFA50610FC5BD0D9C48B6ED0FABF82EC2CE4454310
                                                                                                                                                                                                          Function 00007FF654CACDD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-3474627141
                                                                                                                                                                                                          • Opcode ID: 4b8c868c6939ec88d1abe8f8504a39c26f50d9ef9e938201b9fa1182f5e26e6d
                                                                                                                                                                                                          • Instruction ID: 160d08a1c4d8db08604566c55807b5423ddb61cdb3b3430b03f1b9281f6d1cac
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b8c868c6939ec88d1abe8f8504a39c26f50d9ef9e938201b9fa1182f5e26e6d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8215E66A04F849AD7128F68D8813E97371FF99798F484622EE8C67728DF38D255C300
                                                                                                                                                                                                          Function 00007FF654CA2E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message_errno
                                                                                                                                                                                                          • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                          • API String ID: 1796756983-2410924014
                                                                                                                                                                                                          • Opcode ID: 80f6f717bb9969ece7152c8fde9cb11b8c043fce6b7f1340054d38df66cc8f43
                                                                                                                                                                                                          • Instruction ID: 0f0c90e1c03a1cbd28842ec4c07fd859d7d71d6edf2705573b18a42781d13223
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 80f6f717bb9969ece7152c8fde9cb11b8c043fce6b7f1340054d38df66cc8f43
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7501A2A261CA8091E224DB11F8907EA6374FBC47C0F948132EFCD63B598E3CD246CB40
                                                                                                                                                                                                          Function 00007FF654CACE29 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2468659920
                                                                                                                                                                                                          • Opcode ID: 50bb6e3b89c3acdd8da2640c7def1cf69755cc37c592828175fc8adef2d15e3e
                                                                                                                                                                                                          • Instruction ID: 5ff4d119244352cb4b47f4a5cee92e8a1fd84872159f6b7ed742f4f700e91d03
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 50bb6e3b89c3acdd8da2640c7def1cf69755cc37c592828175fc8adef2d15e3e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E01B166904F888AD711CF69C8802AA3330FF8D798F488322EF8C27724DF28C184C300
                                                                                                                                                                                                          Function 00007FF654CACE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2713391170
                                                                                                                                                                                                          • Opcode ID: 3ea1ec97f37694b9006fc54621547460099b2c1b8ca40b1c9d9b39adf94a092d
                                                                                                                                                                                                          • Instruction ID: 9a56ce93665c2303d4ab2f912c12740723eec1c522abf357ec411255b23e2c6a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea1ec97f37694b9006fc54621547460099b2c1b8ca40b1c9d9b39adf94a092d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C501B166904F888AD711CF69C8902AA3330FF8D799F484322EF8C27724DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4273532761
                                                                                                                                                                                                          • Opcode ID: 48690192945bf7f32f1c5466faad3cff15a9c142b134f494af273dc6dbb7eaa3
                                                                                                                                                                                                          • Instruction ID: 29756801927750c44cda4c2788db84519a6c331a57eeaa591c7bb19d9feb123c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48690192945bf7f32f1c5466faad3cff15a9c142b134f494af273dc6dbb7eaa3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C01B166904F888AD712CF29C8802AA3334FF8D798F488322EF8C27764DF28C185C300
                                                                                                                                                                                                          Function 00007FF654CACE43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4283191376
                                                                                                                                                                                                          • Opcode ID: 671409083fba1ed317bee3cf4e306283cdb16a53cc92c70d1fd336fd5438df01
                                                                                                                                                                                                          • Instruction ID: 983412851e244faf7d01a7a946043e183935905247246f44830078ee0125b515
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 671409083fba1ed317bee3cf4e306283cdb16a53cc92c70d1fd336fd5438df01
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2901B166904F888AD711CF29C8902AA3330FF8D798F484722EF8C27724DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE36 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4064033741
                                                                                                                                                                                                          • Opcode ID: 74916eb7a76916125411d7b1f6d0d259c89befd042e1e24e2dfbcfe61768ada9
                                                                                                                                                                                                          • Instruction ID: 60de4da7dd1c44de1050296ae39041b32620e19bdb2a7de74b7412cd955e8f8b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 74916eb7a76916125411d7b1f6d0d259c89befd042e1e24e2dfbcfe61768ada9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA01B166904F888AD711CF29C8902AA3330FF8D798F484322EF8C67764DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE5D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2187435201
                                                                                                                                                                                                          • Opcode ID: 828440ead5f24b7a3bcef289b9b0c651ba51a82a4e2612c4078c08dbf4f376dd
                                                                                                                                                                                                          • Instruction ID: fb016fedc043421df838e72b29ba9651d528aa472941d7cb9bfbb3d4e921c6d2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 828440ead5f24b7a3bcef289b9b0c651ba51a82a4e2612c4078c08dbf4f376dd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB019E66904F888AD7128F29C8802AA3330FF8D798F484322EF8C27724DF28C185C300
                                                                                                                                                                                                          Function 00007FF654CA61B0 Relevance: 5.0, APIs: 4, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1776766274.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776715346.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776795614.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776820435.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776849485.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776879128.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776908837.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1776934926.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1294909896-0
                                                                                                                                                                                                          • Opcode ID: af07cd424250413d133a4ab32c21d85a647da0b60d227f0190338946df3b41f5
                                                                                                                                                                                                          • Instruction ID: 0698d354b4b25a07765c8f99eb973767fad330d26104eb627c8afaab40cd2894
                                                                                                                                                                                                          • Opcode Fuzzy Hash: af07cd424250413d133a4ab32c21d85a647da0b60d227f0190338946df3b41f5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7FF08295F1A51240FD19E662E8B07BC2A345FC1B40F8C85B2CF4EB7682CE2CE4424310

                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                          Execution Coverage:1.2%
                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                          Total number of Nodes:894
                                                                                                                                                                                                          Total number of Limit Nodes:32
                                                                                                                                                                                                          execution_graph 65412 7ff654ca3680 65413 7ff654ca3696 65412->65413 65414 7ff654ca38f1 65413->65414 65415 7ff654ca36bc 65413->65415 65480 7ff654ca2cd0 10 API calls 65414->65480 65417 7ff654ca38fd 65415->65417 65427 7ff654ca36d4 65415->65427 65481 7ff654ca2cd0 10 API calls 65417->65481 65419 7ff654ca37d0 65423 7ff654ca390e 65426 7ff654ca3a48 65423->65426 65435 7ff654ca3a3d _strdup 65423->65435 65424 7ff654ca37e6 65477 7ff654ca2cd0 10 API calls 65424->65477 65427->65419 65427->65424 65428 7ff654ca37f9 65427->65428 65430 7ff654ca37c1 free 65427->65430 65431 7ff654ca3813 65427->65431 65441 7ff654ca1af0 65427->65441 65469 7ff654ca30b0 65427->65469 65476 7ff654ca1ab0 10 API calls 65427->65476 65478 7ff654ca2cd0 10 API calls 65428->65478 65430->65427 65432 7ff654ca3876 65431->65432 65433 7ff654ca386b _strdup 65431->65433 65472 7ff654ca2230 strlen 65432->65472 65433->65432 65435->65426 65437 7ff654ca3899 _strdup 65438 7ff654ca38c0 65437->65438 65479 7ff654ca2b10 27 API calls 65438->65479 65440 7ff654ca38d7 free free 65440->65419 65442 7ff654ca1b0e 65441->65442 65443 7ff654ca1bf0 65441->65443 65482 7ff654caf2c0 65442->65482 65508 7ff654ca43b0 65443->65508 65447 7ff654ca1c00 65447->65442 65450 7ff654ca1c10 65447->65450 65448 7ff654ca1b26 malloc 65452 7ff654ca1b3f 65448->65452 65453 7ff654ca1c52 65448->65453 65449 7ff654ca1c38 65516 7ff654ca2e50 11 API calls 65449->65516 65515 7ff654ca2cd0 10 API calls 65450->65515 65457 7ff654ca1bd0 65452->65457 65458 7ff654ca1b4b 65452->65458 65517 7ff654ca2e50 11 API calls 65453->65517 65455 7ff654ca1c21 65455->65427 65485 7ff654ca1710 65457->65485 65460 7ff654ca1b60 fread 65458->65460 65461 7ff654ca1b53 65458->65461 65463 7ff654ca1b86 65460->65463 65464 7ff654ca1b58 65460->65464 65466 7ff654ca1bbf 65461->65466 65467 7ff654ca1bb2 fclose 65461->65467 65462 7ff654ca1be1 65462->65461 65468 7ff654ca1b9e free 65462->65468 65514 7ff654ca2e50 11 API calls 65463->65514 65464->65460 65464->65461 65466->65427 65467->65466 65468->65461 65552 7ff654caf480 65469->65552 65474 7ff654ca2260 65472->65474 65473 7ff654ca228b 65473->65423 65473->65437 65474->65473 65560 7ff654ca2cd0 10 API calls 65474->65560 65476->65427 65477->65419 65478->65419 65479->65440 65480->65417 65481->65423 65518 7ff654caf300 65482->65518 65524 7ff654ca8ae0 65485->65524 65487 7ff654ca1779 65488 7ff654ca1783 malloc 65487->65488 65489 7ff654ca19fb 65487->65489 65490 7ff654ca1799 malloc 65488->65490 65491 7ff654ca1a52 65488->65491 65533 7ff654ca2cd0 10 API calls 65489->65533 65494 7ff654ca1a3b 65490->65494 65495 7ff654ca17af 65490->65495 65535 7ff654ca2e50 11 API calls 65491->65535 65534 7ff654ca2e50 11 API calls 65494->65534 65496 7ff654ca17b3 fread 65495->65496 65498 7ff654ca18f5 65495->65498 65502 7ff654ca18c4 65495->65502 65503 7ff654ca1852 fwrite 65495->65503 65496->65498 65499 7ff654ca17db ferror 65496->65499 65528 7ff654caa970 65498->65528 65499->65495 65499->65498 65502->65498 65532 7ff654ca2cd0 10 API calls 65502->65532 65505 7ff654ca187a ferror 65503->65505 65506 7ff654ca19ed 65503->65506 65505->65506 65507 7ff654ca188f 65505->65507 65506->65502 65507->65495 65509 7ff654ca43bd 65508->65509 65536 7ff654ca8210 65509->65536 65512 7ff654ca8210 10 API calls 65513 7ff654ca43ef _wfopen 65512->65513 65513->65447 65514->65468 65515->65455 65516->65455 65517->65461 65519 7ff654caf346 65518->65519 65523 7ff654caf31a 65518->65523 65520 7ff654caf388 _errno 65519->65520 65519->65523 65522 7ff654ca1b1e 65520->65522 65521 7ff654caf39a fsetpos 65521->65522 65522->65448 65522->65449 65523->65521 65523->65522 65525 7ff654ca89f0 65524->65525 65526 7ff654ca8a3e malloc 65525->65526 65527 7ff654ca8a53 65525->65527 65526->65527 65527->65487 65529 7ff654caa97b 65528->65529 65530 7ff654ca1902 free free 65529->65530 65531 7ff654caa991 free 65529->65531 65530->65462 65531->65530 65532->65498 65533->65495 65534->65491 65535->65491 65537 7ff654ca8260 MultiByteToWideChar 65536->65537 65538 7ff654ca8223 65536->65538 65540 7ff654ca8295 calloc 65537->65540 65541 7ff654ca82e8 65537->65541 65539 7ff654ca822d MultiByteToWideChar 65538->65539 65542 7ff654ca82c8 65539->65542 65543 7ff654ca43de 65539->65543 65540->65539 65544 7ff654ca82ab 65540->65544 65551 7ff654ca2db0 10 API calls 65541->65551 65550 7ff654ca2db0 10 API calls 65542->65550 65543->65512 65549 7ff654ca2db0 10 API calls 65544->65549 65548 7ff654ca82c0 65548->65543 65549->65548 65550->65543 65551->65543 65553 7ff654caf4a2 65552->65553 65554 7ff654caf4cb 65552->65554 65558 7ff654cb15f5 fputc 65553->65558 65559 7ff654cb15f5 fputc 65554->65559 65557 7ff654ca30cd 65557->65427 65558->65557 65559->65557 65560->65474 65561 66f86560 PySys_GetObject 65562 66f8658f PyTuple_GetItem 65561->65562 65563 66f86bb7 65561->65563 65562->65563 65564 66f865a6 PyLong_AsLong PyTuple_GetItem 65562->65564 65564->65563 65565 66f865cb PyLong_AsLong PySys_GetObject 65564->65565 65566 66f865f2 GetProcAddress GetProcAddress GetProcAddress PyModule_Create2 65565->65566 65567 66f865e6 PyLong_AsVoidPtr 65565->65567 65566->65563 65568 66f86686 PyModule_GetName 65566->65568 65567->65566 65568->65563 65569 66f8669b strrchr 65568->65569 65570 66f866b8 malloc 65569->65570 65571 66f866ef 65569->65571 65570->65571 65572 66f866d2 memcpy 65570->65572 65573 66f86de0 65571->65573 65574 66f8670e 65571->65574 65572->65571 65575 66f87547 exit 65573->65575 65590 66f86a13 65573->65590 65785 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 65573->65785 65576 66f87289 65574->65576 65577 66f86723 PyBytes_FromStringAndSize 65574->65577 65578 66f87299 65576->65578 65579 66f873c7 65576->65579 65581 66f86741 PyBytes_AsString 65577->65581 65620 66f86bb1 65577->65620 65578->65575 65788 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 65578->65788 65789 66f81660 13 API calls 65579->65789 65584 66f8675a malloc 65581->65584 65585 66f86bd0 65581->65585 65582 66f86e10 65588 66f86e1c PyErr_Format 65582->65588 65582->65590 65583 66f86be6 _Py_Dealloc 65583->65563 65584->65585 65586 66f86771 PyCFunction_NewEx 65584->65586 65593 66f86bda _Py_Dealloc 65585->65593 65585->65620 65591 66f86bf1 65586->65591 65592 66f867b6 PyCFunction_NewEx 65586->65592 65601 66f86e50 65588->65601 65595 66f872b9 PyErr_Format 65590->65595 65597 66f87264 65590->65597 65603 66f8750d 65590->65603 65612 66f86a2e 65590->65612 65599 66f86bff 65591->65599 65600 66f86d30 _Py_Dealloc 65591->65600 65592->65591 65598 66f867f9 PyCFunction_NewEx 65592->65598 65593->65563 65593->65583 65613 66f872ef 65595->65613 65598->65591 65605 66f8683c PyBytes_FromStringAndSize 65598->65605 65599->65585 65600->65590 65614 66f86e6b PyBytes_AsStringAndSize 65601->65614 65601->65620 65602 66f86a53 65737 66f9f730 65602->65737 65797 66f81660 13 API calls 65603->65797 65608 66f8686d PyBytes_AsString 65605->65608 65605->65620 65611 66f93b40 65608->65611 65609 66f874d5 65796 66f81660 13 API calls 65609->65796 65610 66f86aa6 65616 66f86ab2 65610->65616 65617 66f874b7 65610->65617 65618 66f8694b _time64 srand 65611->65618 65612->65597 65612->65620 65696 66f9eed0 65612->65696 65621 66f87300 65613->65621 65622 66f87442 65613->65622 65614->65620 65634 66f86e87 65614->65634 65624 66f86c05 malloc 65616->65624 65628 66f86b4b 65616->65628 65629 66f86af0 strstr 65616->65629 65795 66f81660 13 API calls 65617->65795 65774 66f9d4d0 __iob_func abort 65618->65774 65620->65563 65620->65583 65621->65575 65642 66f87313 65621->65642 65792 66f880b0 7 API calls 65622->65792 65623 66f86ee2 65623->65622 65641 66f86f09 memcpy 65623->65641 65630 66f874f9 _errno 65624->65630 65631 66f86c20 65624->65631 65627 66f86ec5 65786 66f880b0 7 API calls 65627->65786 65638 66f86b5c 65628->65638 65639 66f874f0 65628->65639 65629->65628 65635 66f86b0c 65629->65635 65636 66f87410 65630->65636 65781 66f87d60 memcpy strlen memcpy __iob_func abort 65631->65781 65632 66f86985 65632->65613 65775 66f9d940 10 API calls 65632->65775 65634->65623 65634->65627 65635->65628 65643 66f86b27 strncmp 65635->65643 65790 66f87fb0 8 API calls 65636->65790 65638->65575 65644 66f86b73 65638->65644 65639->65630 65641->65590 65648 66f86f1f _Py_Dealloc 65641->65648 65649 66f87333 PyErr_Format 65642->65649 65643->65624 65643->65628 65780 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 65644->65780 65645 66f86c43 65782 66ffe8b0 __iob_func abort 65645->65782 65648->65590 65649->65620 65651 66f8699a 65651->65613 65776 66f9d6b0 10 API calls 65651->65776 65653 66f8741a _errno 65653->65620 65654 66f86b80 65656 66f8746c 65654->65656 65657 66f86b8c PyErr_Format 65654->65657 65655 66f86c5f 65659 66f87427 65655->65659 65660 66f86c67 65655->65660 65793 66f81660 13 API calls 65656->65793 65657->65620 65791 66f81660 13 API calls 65659->65791 65662 66f86c79 malloc 65660->65662 65663 66f86c74 free 65660->65663 65665 66f87401 _errno 65662->65665 65666 66f86c96 memcpy 65662->65666 65663->65662 65664 66f869af 65664->65613 65777 66f9d0e0 10 API calls 65664->65777 65665->65636 65668 66f86f50 65666->65668 65669 66f86cb7 65666->65669 65668->65575 65691 66f87353 65668->65691 65787 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 65668->65787 65671 66f86cbd 65669->65671 65672 66f86d70 65669->65672 65676 66f86cd2 free 65671->65676 65677 66f86cd7 malloc 65671->65677 65687 66f86d06 65671->65687 65672->65575 65672->65691 65784 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 65672->65784 65673 66f869c4 65674 66f87499 65673->65674 65675 66f869d2 65673->65675 65794 66f81660 13 API calls 65674->65794 65778 66f9d380 10 API calls 65675->65778 65676->65677 65683 66f87533 _errno 65677->65683 65684 66f86cf4 memcpy 65677->65684 65682 66f869de 65682->65656 65779 66f9d230 10 API calls 65682->65779 65683->65636 65684->65687 65685 66f86f81 65689 66f86f8d PyErr_Format 65685->65689 65685->65691 65686 66f86d0e 65686->65620 65695 66f86d16 65686->65695 65687->65686 65783 66f84050 exit 65687->65783 65688 66f86da1 65690 66f86dad PyErr_Format 65688->65690 65688->65691 65689->65620 65690->65620 65691->65595 65694 66f869f8 65694->65590 65694->65601 65694->65603 65695->65563 65697 66f9f34c 65696->65697 65698 66f9eef0 65696->65698 65805 66f9d070 __iob_func abort 65697->65805 65699 66f9f333 65698->65699 65702 66f9ef0b 65698->65702 65703 66f9f31a 65698->65703 65804 66f9d070 __iob_func abort 65699->65804 65711 66f86a4b 65702->65711 65712 66f9ef65 calloc 65702->65712 65803 66f9d070 __iob_func abort 65703->65803 65711->65579 65711->65602 65716 66f9ef84 65712->65716 65721 66f9f068 65712->65721 65798 66fa1c30 6 API calls 65716->65798 65718 66f9efba 65719 66f9efbe 65718->65719 65720 66f9f030 65718->65720 65799 66fa1ac0 __iob_func abort calloc free 65719->65799 65800 66fa1ac0 __iob_func abort calloc free 65720->65800 65724 66f9f290 65721->65724 65725 66f9f123 65721->65725 65733 66f9f014 65721->65733 65724->65733 65802 66fa1ac0 __iob_func abort calloc free 65724->65802 65725->65733 65801 66fa1ac0 __iob_func abort calloc free 65725->65801 65726 66f9f01e free 65726->65711 65733->65726 65738 66f9f9cb 65737->65738 65742 66f9f76f 65737->65742 65810 66f9d070 __iob_func abort 65738->65810 65740 66f9f9b2 65809 66f9d070 __iob_func abort 65740->65809 65741 66f9f999 65808 66f9d070 __iob_func abort 65741->65808 65742->65740 65742->65741 65745 66f9f980 65742->65745 65754 66f9f78a 65742->65754 65744 66f9f9e4 memcmp 65747 66f9f9fa 65744->65747 65748 66f9f8ee free 65744->65748 65807 66f9d070 __iob_func abort 65745->65807 65747->65748 65750 66f9f8f6 free 65748->65750 65752 66f9f905 65750->65752 65751 66f86a9e 65751->65609 65751->65610 65752->65750 65753 66fa36f0 21 API calls 65752->65753 65753->65752 65754->65751 65755 66f9f804 malloc 65754->65755 65755->65751 65756 66f9f81b 65755->65756 65756->65750 65757 66f9f85a free 65756->65757 65758 66f9f86e 65756->65758 65757->65751 65758->65752 65759 66f9f877 malloc 65758->65759 65759->65750 65760 66f9f8a9 65759->65760 65806 66fa3f80 memcpy 65760->65806 65762 66f9f8d8 65762->65748 65763 66f9f951 65762->65763 65764 66f9f8e3 65762->65764 65763->65752 65811 66fa1010 __iob_func abort 65763->65811 65764->65744 65764->65748 65766 66f9fb01 65767 66f9fb4b 65766->65767 65812 66fa1010 __iob_func abort 65766->65812 65769 66f9fbed free 65767->65769 65770 66f9fb6f 65767->65770 65770->65748 65771 66f9fb9d memcmp 65770->65771 65771->65748 65772 66f9fbbf 65771->65772 65772->65748 65773 66f9fbcd memcmp 65772->65773 65773->65747 65773->65748 65774->65632 65775->65651 65776->65664 65777->65673 65778->65682 65779->65694 65780->65654 65781->65645 65782->65655 65784->65688 65785->65582 65786->65620 65787->65685 65788->65595 65789->65620 65790->65653 65791->65620 65792->65620 65793->65620 65794->65686 65795->65620 65796->65620 65797->65620 65798->65718 65799->65733 65800->65721 65801->65733 65802->65733 65806->65762 65811->65766 65812->65767 65813 7ff654ca10f6 65816 7ff654ca1154 65813->65816 65817 7ff654ca118b 65816->65817 65818 7ff654ca11f1 _amsg_exit 65817->65818 65819 7ff654ca11fd 65817->65819 65820 7ff654ca1232 65818->65820 65819->65820 65821 7ff654ca120a _initterm 65819->65821 65822 7ff654ca124a _initterm 65820->65822 65823 7ff654ca1270 65820->65823 65821->65820 65822->65823 65832 7ff654ca147c 65823->65832 65825 7ff654ca1309 65837 7ff654cacba0 65825->65837 65828 7ff654ca1350 exit 65829 7ff654ca135d 65828->65829 65830 7ff654ca1367 _cexit 65829->65830 65831 7ff654ca1117 65829->65831 65830->65831 65833 7ff654ca14a2 65832->65833 65834 7ff654ca1558 65833->65834 65835 7ff654ca14bd 65833->65835 65834->65825 65836 7ff654ca14dc malloc memcpy 65835->65836 65836->65833 65839 7ff654cacbc6 65837->65839 65838 7ff654cacc48 memset 65840 7ff654cacc6f 65838->65840 65839->65838 65843 7ff654ca16d0 65840->65843 65914 7ff654ca8160 65843->65914 65845 7ff654ca16f3 65922 7ff654ca21b0 calloc 65845->65922 65851 7ff654ca3b9a 65888 7ff654ca3e43 65851->65888 65937 7ff654ca6fe0 65851->65937 65855 7ff654ca3be7 65858 7ff654ca3d50 65855->65858 65859 7ff654ca3bf3 65855->65859 65856 7ff654ca3fea fclose 65856->65888 65857 7ff654ca20b0 41 API calls 65869 7ff654ca3c4e 65857->65869 65861 7ff654ca70d0 12 API calls 65858->65861 65860 7ff654ca6fe0 15 API calls 65859->65860 65863 7ff654ca3bff 65860->65863 65862 7ff654ca3d58 65861->65862 65864 7ff654ca20b0 41 API calls 65862->65864 65866 7ff654ca3c38 65863->65866 65870 7ff654ca3f00 65863->65870 65871 7ff654ca3c1b free 65863->65871 65867 7ff654ca3d66 65864->65867 65865 7ff654ca8210 10 API calls 65865->65869 65945 7ff654ca70d0 65866->65945 65867->65870 65873 7ff654ca3d6e 65867->65873 65869->65857 65869->65865 65875 7ff654ca3c90 SetDllDirectoryW 65869->65875 65869->65888 65893 7ff654ca3cf1 strcpy 65869->65893 65972 7ff654ca61b0 free free free free 65869->65972 65973 7ff654ca3b20 fputc 65869->65973 65876 7ff654ca20b0 41 API calls 65870->65876 65872 7ff654ca70d0 12 API calls 65871->65872 65872->65866 65976 7ff654ca3520 10 API calls 65873->65976 65874 7ff654ca3c40 65948 7ff654ca20b0 65874->65948 65959 7ff654ca6170 calloc 65875->65959 65881 7ff654ca3d84 65876->65881 65879 7ff654ca2cd0 10 API calls 65879->65888 65881->65856 65882 7ff654ca3e3e 65881->65882 65885 7ff654ca43b0 11 API calls 65881->65885 65881->65888 65977 7ff654ca7d30 malloc 65881->65977 65986 7ff654ca3520 10 API calls 65881->65986 65883 7ff654ca6170 12 API calls 65882->65883 65883->65888 65885->65881 65887 7ff654ca3cb9 strcmp 65887->65869 65889 7ff654ca3d0a 65887->65889 65888->65856 65888->65869 65888->65879 65888->65887 65891 7ff654ca61b0 free free free free 65888->65891 65903 7ff654ca3eb2 65888->65903 65987 7ff654ca5cc0 40 API calls 65888->65987 65988 7ff654ca3580 135 API calls 65888->65988 65989 7ff654ca7070 13 API calls 65888->65989 65994 7ff654ca5ee0 119 API calls 65888->65994 65995 7ff654ca6100 43 API calls 65888->65995 65996 7ff654ca6310 FreeLibrary 65888->65996 65998 7ff654ca6430 11 API calls 65888->65998 65963 7ff654ca3aa0 65889->65963 65891->65888 65893->65889 65895 7ff654ca3d1a 65974 7ff654ca6310 FreeLibrary 65895->65974 65900 7ff654ca3d2e 65975 7ff654ca61b0 free free free free 65900->65975 65902 7ff654ca1340 65902->65828 65902->65829 65990 7ff654ca79c0 22 API calls 65903->65990 65905 7ff654ca3ec8 65991 7ff654ca6310 FreeLibrary 65905->65991 65907 7ff654ca3ed4 65992 7ff654ca61b0 free free free free 65907->65992 65909 7ff654ca3ede 65910 7ff654ca3eeb 65909->65910 65997 7ff654ca7490 30 API calls 65909->65997 65993 7ff654ca21f0 free fclose 65910->65993 65913 7ff654ca3ef3 65913->65902 65915 7ff654ca817e 65914->65915 65916 7ff654ca81d9 65915->65916 65918 7ff654ca818a 65915->65918 65916->65845 65918->65916 65919 7ff654ca81b1 65918->65919 65999 7ff654ca8040 13 API calls 65918->65999 65920 7ff654ca81c0 free 65919->65920 65920->65920 65921 7ff654ca81d1 free 65920->65921 65921->65916 65923 7ff654ca21c8 65922->65923 65924 7ff654ca21cd 65922->65924 65923->65888 65926 7ff654ca42f0 65923->65926 66000 7ff654ca2e50 11 API calls 65924->66000 66001 7ff654cae230 65926->66001 65928 7ff654ca42fc GetModuleFileNameW 65929 7ff654ca4348 65928->65929 65930 7ff654ca431c 65928->65930 66004 7ff654ca2db0 10 API calls 65929->66004 66003 7ff654ca8040 13 API calls 65930->66003 65933 7ff654ca432d 65934 7ff654ca433a 65933->65934 66005 7ff654ca2cd0 10 API calls 65933->66005 65934->65851 65936 7ff654ca436c 65936->65934 65938 7ff654ca6feb 65937->65938 65939 7ff654ca8210 10 API calls 65938->65939 65940 7ff654ca7000 GetEnvironmentVariableW 65939->65940 65941 7ff654ca7016 65940->65941 65942 7ff654ca7028 ExpandEnvironmentStringsW 65940->65942 65941->65855 66006 7ff654ca8040 13 API calls 65942->66006 65944 7ff654ca704c 65944->65855 65944->65941 65946 7ff654ca8210 10 API calls 65945->65946 65947 7ff654ca70e3 SetEnvironmentVariableW free 65946->65947 65947->65874 66007 7ff654ca1a80 65948->66007 65951 7ff654ca20df 65951->65869 65952 7ff654ca1a80 fputc 65953 7ff654ca210b 65952->65953 65953->65951 66010 7ff654ca4040 65953->66010 65958 7ff654ca2158 fclose 65958->65951 65960 7ff654ca618d 65959->65960 65962 7ff654ca6188 65959->65962 66077 7ff654ca2e50 11 API calls 65960->66077 65962->65869 66078 7ff654ca51d0 65963->66078 65971 7ff654ca3adb 65971->65895 65972->65887 65973->65869 65974->65900 65975->65902 65976->65881 65978 7ff654ca7d5f 65977->65978 65985 7ff654ca7e19 free 65977->65985 65979 7ff654caf2c0 2 API calls 65978->65979 65981 7ff654ca7d6f 65979->65981 65981->65985 66223 7ff654caf3b0 65981->66223 65983 7ff654caf2c0 2 API calls 65984 7ff654ca7d7f 65983->65984 65984->65983 65984->65985 65985->65881 65986->65881 65987->65888 65988->65888 65989->65888 65990->65905 65991->65907 65992->65909 65993->65913 65994->65888 65995->65888 65996->65888 65997->65910 65998->65888 65999->65918 66000->65923 66002 7ff654cae23f 66001->66002 66002->65928 66002->66002 66003->65933 66004->65934 66005->65936 66006->65944 66008 7ff654caf480 fputc 66007->66008 66009 7ff654ca1aa4 66008->66009 66009->65951 66009->65952 66011 7ff654ca404c 66010->66011 66047 7ff654ca4010 66011->66047 66014 7ff654ca2124 strcpy 66018 7ff654ca1e80 66014->66018 66017 7ff654ca4010 fputc 66017->66014 66019 7ff654ca2020 66018->66019 66020 7ff654ca1e96 66018->66020 66022 7ff654ca43b0 11 API calls 66019->66022 66021 7ff654ca7d30 5 API calls 66020->66021 66024 7ff654ca200c 66020->66024 66023 7ff654ca1ec0 66021->66023 66022->66020 66023->66024 66025 7ff654caf2c0 2 API calls 66023->66025 66024->65951 66024->65958 66026 7ff654ca1ed9 66025->66026 66027 7ff654ca1ee1 fread 66026->66027 66028 7ff654ca2085 66026->66028 66030 7ff654ca1f01 66027->66030 66031 7ff654ca2048 66027->66031 66075 7ff654ca2e50 11 API calls 66028->66075 66033 7ff654caf2c0 2 API calls 66030->66033 66072 7ff654ca2e50 11 API calls 66031->66072 66034 7ff654ca1f4b malloc 66033->66034 66035 7ff654ca1f67 fread 66034->66035 66036 7ff654ca209a 66034->66036 66037 7ff654ca1f81 ferror 66035->66037 66038 7ff654ca2062 66035->66038 66076 7ff654ca2e50 11 API calls 66036->66076 66040 7ff654ca2077 66037->66040 66044 7ff654ca1f9f 66037->66044 66073 7ff654ca2e50 11 API calls 66038->66073 66074 7ff654ca2cd0 10 API calls 66040->66074 66043 7ff654ca1ff3 66043->66024 66045 7ff654ca2000 fclose 66043->66045 66044->66043 66071 7ff654ca2cd0 10 API calls 66044->66071 66045->66024 66048 7ff654caf480 fputc 66047->66048 66049 7ff654ca4034 66048->66049 66049->66014 66050 7ff654cae5e0 66049->66050 66051 7ff654cae604 66050->66051 66052 7ff654cae61f setlocale 66051->66052 66053 7ff654cae60f _strdup 66051->66053 66054 7ff654cae63e 66052->66054 66055 7ff654caea6b wcstombs realloc wcstombs setlocale free 66052->66055 66053->66052 66054->66055 66056 7ff654cae64d mbstowcs 66054->66056 66057 7ff654ca4082 66055->66057 66058 7ff654cae230 66056->66058 66057->66017 66059 7ff654cae6a6 mbstowcs 66058->66059 66060 7ff654cae6f4 66059->66060 66061 7ff654cae75b 66059->66061 66060->66061 66063 7ff654cae735 setlocale free 66060->66063 66062 7ff654caea61 66061->66062 66064 7ff654cae78b 66061->66064 66062->66055 66063->66057 66065 7ff654cae80a wcstombs realloc wcstombs 66064->66065 66070 7ff654cae80f wcstombs 66064->66070 66067 7ff654caea3e setlocale free 66065->66067 66067->66057 66069 7ff654cae995 66069->66067 66070->66067 66070->66069 66071->66044 66072->66024 66073->66024 66074->66024 66075->66024 66076->66024 66077->65962 66079 7ff654ca51de 66078->66079 66154 7ff654ca4f60 66079->66154 66082 7ff654ca5210 66086 7ff654ca40e0 4 API calls 66082->66086 66103 7ff654ca521f 66082->66103 66083 7ff654ca52e7 66179 7ff654ca2cd0 10 API calls 66083->66179 66085 7ff654ca3aad 66085->65971 66104 7ff654ca5550 66085->66104 66088 7ff654ca5289 66086->66088 66090 7ff654ca528e 66088->66090 66178 7ff654ca2cd0 10 API calls 66088->66178 66089 7ff654ca5234 66091 7ff654ca5239 66089->66091 66177 7ff654ca2cd0 10 API calls 66089->66177 66170 7ff654ca4210 66090->66170 66167 7ff654ca7950 66091->66167 66097 7ff654ca5241 66098 7ff654ca5309 66097->66098 66099 7ff654ca524d 66097->66099 66180 7ff654ca2db0 10 API calls 66098->66180 66176 7ff654ca4410 65 API calls 66099->66176 66101 7ff654ca7950 12 API calls 66101->66103 66157 7ff654ca40e0 66103->66157 66105 7ff654ca6fe0 15 API calls 66104->66105 66108 7ff654ca5566 66105->66108 66106 7ff654ca5586 66107 7ff654ca8210 10 API calls 66106->66107 66109 7ff654ca55d2 66107->66109 66108->66106 66211 7ff654ca2d40 10 API calls 66108->66211 66111 7ff654ca55db 66109->66111 66112 7ff654ca579c 66109->66112 66114 7ff654ca8210 10 API calls 66111->66114 66215 7ff654ca2cd0 10 API calls 66112->66215 66115 7ff654ca5606 66114->66115 66117 7ff654ca560f 66115->66117 66118 7ff654ca57b8 66115->66118 66116 7ff654ca3ac3 66116->65971 66143 7ff654ca57d0 strlen 66116->66143 66120 7ff654ca4f60 fputc 66117->66120 66217 7ff654ca2cd0 10 API calls 66118->66217 66121 7ff654ca567b 66120->66121 66122 7ff654ca5777 66121->66122 66123 7ff654ca5686 66121->66123 66213 7ff654ca2cd0 10 API calls 66122->66213 66124 7ff654ca8210 10 API calls 66123->66124 66126 7ff654ca569e 66124->66126 66127 7ff654ca56a7 66126->66127 66128 7ff654ca57aa 66126->66128 66194 7ff654ca4fb0 66127->66194 66216 7ff654ca2cd0 10 API calls 66128->66216 66132 7ff654ca56cd 66210 7ff654ca8310 13 API calls 66132->66210 66134 7ff654ca56eb 66135 7ff654ca578e 66134->66135 66136 7ff654ca56f7 66134->66136 66214 7ff654ca2cd0 10 API calls 66135->66214 66139 7ff654ca5732 free 66136->66139 66140 7ff654ca5720 free 66136->66140 66138 7ff654ca579a 66138->66116 66141 7ff654ca5743 66139->66141 66140->66139 66140->66140 66141->66116 66212 7ff654ca2cd0 10 API calls 66141->66212 66144 7ff654ca580d 66143->66144 66145 7ff654ca58f1 66144->66145 66152 7ff654ca5819 66144->66152 66222 7ff654ca2cd0 10 API calls 66145->66222 66147 7ff654ca3acf 66147->65971 66153 7ff654ca59e0 11 API calls 66147->66153 66149 7ff654ca1af0 28 API calls 66149->66152 66151 7ff654ca58b9 free 66151->66152 66152->66147 66152->66149 66152->66151 66220 7ff654ca1ab0 10 API calls 66152->66220 66221 7ff654ca2cd0 10 API calls 66152->66221 66153->65971 66155 7ff654caf480 fputc 66154->66155 66156 7ff654ca4f78 66155->66156 66156->66082 66156->66083 66158 7ff654ca4010 fputc 66157->66158 66159 7ff654ca4101 66158->66159 66160 7ff654ca4178 66159->66160 66161 7ff654ca4124 strlen 66159->66161 66160->66089 66161->66160 66162 7ff654ca4139 66161->66162 66163 7ff654ca4160 66162->66163 66164 7ff654ca4149 strncat 66162->66164 66166 7ff654ca4165 strlen 66163->66166 66165 7ff654ca414e 66164->66165 66165->66089 66166->66165 66168 7ff654ca8210 10 API calls 66167->66168 66169 7ff654ca7963 LoadLibraryExW free 66168->66169 66169->66097 66171 7ff654ca421b 66170->66171 66172 7ff654ca8210 10 API calls 66171->66172 66173 7ff654ca4234 66172->66173 66181 7ff654caf1bb 66173->66181 66176->66085 66177->66091 66178->66090 66179->66085 66180->66085 66188 7ff654caefd0 66181->66188 66183 7ff654caf1d7 66184 7ff654caf204 66183->66184 66185 7ff654caf1f8 free 66183->66185 66186 7ff654caf20a memset 66184->66186 66187 7ff654ca4241 66184->66187 66185->66184 66186->66187 66187->66101 66187->66103 66189 7ff654caefef 66188->66189 66190 7ff654caf031 66188->66190 66189->66190 66191 7ff654caefff wcslen 66189->66191 66190->66183 66191->66190 66193 7ff654caf014 66191->66193 66192 7ff654caf166 malloc memcpy 66192->66190 66193->66190 66193->66192 66195 7ff654ca4fc4 66194->66195 66196 7ff654ca5062 strncmp 66195->66196 66198 7ff654ca508a mbstowcs 66195->66198 66200 7ff654ca50d8 66195->66200 66203 7ff654ca50dd 66195->66203 66218 7ff654ca1ab0 10 API calls 66195->66218 66196->66195 66198->66195 66199 7ff654ca51b6 66198->66199 66219 7ff654ca2cd0 10 API calls 66199->66219 66202 7ff654ca512b _setmode 66200->66202 66200->66203 66204 7ff654ca5142 _fileno _setmode 66202->66204 66203->66132 66205 7ff654ca515a fflush 66204->66205 66206 7ff654ca5169 fflush 66205->66206 66207 7ff654ca5175 66206->66207 66208 7ff654ca5186 setbuf 66207->66208 66209 7ff654ca5197 setbuf 66208->66209 66209->66203 66210->66134 66211->66106 66212->66116 66213->66116 66214->66138 66215->66116 66216->66116 66217->66116 66218->66195 66219->66203 66220->66152 66221->66152 66222->66147 66226 7ff654caf3d0 fgetpos 66223->66226 66227 7ff654caf3c8 66226->66227 66227->65984 66228 66f85861 66229 66f85e59 66228->66229 66232 66f85860 66228->66232 66230 66f86091 66229->66230 66235 66f8634c exit 66229->66235 66351 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66229->66351 66230->66235 66231 66f8587b 66233 66f858a9 66231->66233 66234 66f85881 66231->66234 66232->66228 66232->66231 66245 66f862d7 66233->66245 66289 66f87560 66233->66289 66350 66f8f750 VirtualAlloc memcpy fwrite 66234->66350 66239 66f86374 66235->66239 66240 66f86485 66235->66240 66243 66f86384 66239->66243 66354 66f8f870 VirtualFree 66239->66354 66242 66f85e88 66242->66230 66247 66f85e94 PyErr_Format 66242->66247 66244 66f863ac 66243->66244 66252 66f8639c free 66243->66252 66257 66f863bd free 66244->66257 66258 66f863c2 66244->66258 66353 66f880b0 7 API calls 66245->66353 66246 66f854b0 PyEval_GetFrame 66251 66f854d1 PyUnicode_FromFormat 66246->66251 66269 66f85542 66246->66269 66247->66230 66249 66f858e3 66253 66f858f8 PyUnicode_AsUTF8 66249->66253 66259 66f86179 66249->66259 66256 66f854ea Py_DecRef 66251->66256 66251->66269 66252->66243 66252->66244 66260 66f85938 PyImport_GetModuleDict PyDict_GetItem 66253->66260 66261 66f8591e 66253->66261 66254 66f85ab4 PyEval_GetFrame 66254->66249 66255 66f86308 66255->66235 66255->66246 66256->66269 66257->66258 66262 66f863ce free 66258->66262 66263 66f863d3 66258->66263 66259->66235 66259->66245 66352 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66259->66352 66264 66f8597d PyImport_ExecCodeModuleObject PyErr_Occurred 66260->66264 66265 66f85954 PyModule_GetDict PyDict_GetItemString 66260->66265 66261->66260 66261->66264 66262->66263 66266 66f863df free 66263->66266 66267 66f863e4 66263->66267 66264->66246 66264->66269 66265->66264 66268 66f860c5 PyEval_EvalCode 66265->66268 66266->66267 66271 66f863ed free 66267->66271 66272 66f863f2 66267->66272 66273 66f854fb PyEval_GetFrame 66268->66273 66274 66f860dd Py_DecRef Py_IncRef 66268->66274 66271->66272 66277 66f86408 66272->66277 66281 66f864c2 _Py_Dealloc 66272->66281 66273->66269 66275 66f8551c PyUnicode_FromFormat 66273->66275 66274->66269 66275->66269 66279 66f85535 Py_DecRef 66275->66279 66276 66f861a8 66276->66245 66280 66f861b4 PyErr_Format 66276->66280 66278 66f8641b 66277->66278 66282 66f864e0 _Py_Dealloc 66277->66282 66283 66f86500 _Py_Dealloc 66278->66283 66285 66f86431 66278->66285 66279->66269 66280->66246 66281->66277 66281->66278 66282->66278 66282->66285 66283->66240 66283->66285 66284 66f86530 _Py_Dealloc 66284->66285 66285->66240 66285->66284 66286 66f86550 _Py_Dealloc 66285->66286 66287 66f86540 _Py_Dealloc 66285->66287 66288 66f86520 _Py_Dealloc 66285->66288 66286->66285 66287->66285 66288->66284 66290 66f8758a 66289->66290 66291 66f878d0 66289->66291 66292 66f87593 66290->66292 66301 66f878e6 66290->66301 66431 66ffe970 __iob_func abort 66291->66431 66294 66f87a10 66292->66294 66299 66f875a9 66292->66299 66295 66f87d4b exit 66294->66295 66342 66f87b3f PyErr_Format 66294->66342 66435 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66294->66435 66296 66f8761d 66300 66f8762c 66296->66300 66316 66f87a90 66296->66316 66298 66f875cb malloc 66303 66f87cec PyErr_NoMemory 66298->66303 66304 66f875e1 66298->66304 66299->66296 66299->66298 66305 66f87b90 66299->66305 66429 66f8e850 17 API calls 66300->66429 66301->66294 66301->66295 66301->66305 66307 66f8798b PyErr_Format 66301->66307 66308 66f87b00 66301->66308 66317 66f87923 PyErr_Format 66301->66317 66318 66f87cd5 66301->66318 66332 66f87c9c PyErr_Format 66301->66332 66432 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66301->66432 66433 66ffe9d0 __iob_func abort 66301->66433 66434 66ffeca0 __iob_func abort 66301->66434 66312 66f858cb 66303->66312 66320 66f875f3 66304->66320 66321 66f87ce4 free 66304->66321 66305->66295 66313 66f87bc2 66305->66313 66307->66301 66323 66f87b20 66308->66323 66333 66f87bcf PyErr_Format 66308->66333 66309 66f87a4f 66314 66f87a5b PyErr_Format 66309->66314 66309->66342 66310 66f87645 66310->66312 66324 66f87659 66310->66324 66325 66f878b3 memset 66310->66325 66312->66246 66312->66249 66312->66254 66438 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66313->66438 66314->66316 66316->66295 66436 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66316->66436 66317->66301 66318->66321 66355 66f93b90 66320->66355 66321->66303 66323->66295 66328 66f87b32 66323->66328 66329 66f87880 PyEval_GetFrame 66324->66329 66330 66f87661 66324->66330 66325->66324 66325->66330 66327 66f87abf 66335 66f87acb PyErr_Format 66327->66335 66327->66342 66437 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66328->66437 66329->66308 66339 66f87893 66329->66339 66330->66312 66338 66f876b0 PyEval_GetFrame 66330->66338 66332->66312 66333->66312 66334 66f87614 66334->66296 66341 66f87c6d 66334->66341 66335->66308 66349 66f876bf 66338->66349 66339->66308 66339->66330 66341->66295 66344 66f87c8f 66341->66344 66342->66312 66343 66f87835 66430 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66343->66430 66439 66f813c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 66344->66439 66347 66f87842 66347->66332 66348 66f8784e PyErr_Format 66347->66348 66348->66312 66349->66295 66349->66312 66349->66332 66349->66343 66350->66233 66351->66242 66352->66276 66353->66255 66440 66fe0b90 66355->66440 66360 66fe12c0 malloc 66361 66f93bc9 66360->66361 66452 66fe0cf0 66361->66452 66372 66fdfbf0 malloc 66373 66f93c56 66372->66373 66374 66fdf980 malloc 66373->66374 66375 66f93c6c 66374->66375 66376 66fdfbf0 malloc 66375->66376 66377 66f93c9c 66376->66377 66478 66fdf840 66377->66478 66381 66f93cb4 66485 66fe0750 66381->66485 66384 66fe0750 2 API calls 66385 66f93ccf 66384->66385 66386 66fdf840 malloc 66385->66386 66394 66f93ce2 66386->66394 66387 66f93d60 66388 66fdf840 malloc 66387->66388 66389 66f93d78 66388->66389 66390 66fe0750 2 API calls 66389->66390 66391 66f93d89 66390->66391 66393 66fdfbf0 malloc 66391->66393 66392 66f944a0 66395 66fdfbf0 malloc 66392->66395 66396 66f93dac 66393->66396 66394->66387 66394->66392 66397 66fdfbf0 malloc 66394->66397 66428 66f93f62 66394->66428 66398 66f944b2 66395->66398 66399 66fdfbf0 malloc 66396->66399 66397->66394 66400 66f93dce 66399->66400 66401 66fdfbf0 malloc 66400->66401 66402 66f93ded 66401->66402 66403 66fdfbf0 malloc 66402->66403 66404 66f93e0f 66403->66404 66405 66fdfbf0 malloc 66404->66405 66406 66f93e2b 66405->66406 66407 66fdfbf0 malloc 66406->66407 66408 66f93e4a 66407->66408 66409 66fdfbf0 malloc 66408->66409 66410 66f93e69 66409->66410 66411 66fdfbf0 malloc 66410->66411 66412 66f93e8b 66411->66412 66413 66fdfbf0 malloc 66412->66413 66414 66f93ea7 66413->66414 66415 66fdfbf0 malloc 66414->66415 66416 66f93ec9 66415->66416 66417 66fdfbf0 malloc 66416->66417 66418 66f93ee8 66417->66418 66419 66fdfbf0 malloc 66418->66419 66420 66f93f0a 66419->66420 66421 66fdfbf0 malloc 66420->66421 66422 66f93f26 66421->66422 66423 66fdfbf0 malloc 66422->66423 66424 66f93f48 66423->66424 66491 66fe0ec0 66424->66491 66426 66f93f52 66498 66ffd980 66426->66498 66428->66334 66429->66310 66430->66347 66431->66301 66432->66301 66433->66301 66434->66301 66435->66309 66436->66327 66437->66342 66438->66333 66439->66332 66441 66fe0baa 66440->66441 66521 66ffde00 malloc 66441->66521 66443 66fe0c70 66444 66fdd170 malloc 66443->66444 66445 66fe0c88 66444->66445 66446 66fdd170 malloc 66445->66446 66447 66f93bb6 66446->66447 66448 66fe12c0 66447->66448 66449 66fe12e0 66448->66449 66522 66fdd170 66449->66522 66453 66fe0d0c 66452->66453 66454 66f93bd9 66453->66454 66455 66fdf980 malloc 66453->66455 66456 66fe18c0 66454->66456 66455->66454 66527 66fdf9d0 66456->66527 66459 66fe190c 66461 66fdfbf0 malloc 66459->66461 66460 66fe1951 66462 66fdf980 malloc 66460->66462 66463 66f93bf0 66461->66463 66462->66463 66464 66fdfbf0 66463->66464 66465 66fdd170 malloc 66464->66465 66466 66f93c14 66465->66466 66467 66fe1760 66466->66467 66468 66fdf9d0 malloc 66467->66468 66469 66fe1780 66468->66469 66470 66fe17ac 66469->66470 66471 66fe17f1 66469->66471 66472 66fdfbf0 malloc 66470->66472 66473 66fdf980 malloc 66471->66473 66474 66f93c21 66472->66474 66473->66474 66475 66fdf980 66474->66475 66476 66fdd170 malloc 66475->66476 66477 66f93c37 66476->66477 66477->66372 66479 66fdd170 malloc 66478->66479 66480 66f93cac 66479->66480 66481 66fdff50 66480->66481 66482 66fdff66 66481->66482 66483 66fdd170 malloc 66482->66483 66484 66fdff79 66482->66484 66483->66484 66484->66381 66486 66fe0765 66485->66486 66487 66fdff50 malloc 66486->66487 66489 66fe06e0 66486->66489 66487->66489 66488 66f93cc4 66488->66384 66489->66488 66530 66fe00a0 abort 66489->66530 66492 66fdf840 malloc 66491->66492 66493 66fe0ed9 66492->66493 66494 66fdf980 malloc 66493->66494 66495 66fe0f0e 66494->66495 66531 66fe0d70 66495->66531 66499 66ffd99c 66498->66499 66513 66ffdaa5 66498->66513 66501 66ffdb19 66499->66501 66503 66ffd9ba 66499->66503 66505 66ffdb40 66499->66505 66550 66fff2c0 66501->66550 66502 66fff2c0 9 API calls 66502->66513 66563 66fec5a0 6 API calls 66503->66563 66505->66502 66505->66513 66507 66ffdc19 memset 66507->66513 66509 66ffdab7 66512 66ffdad0 66509->66512 66546 67000940 66509->66546 66511 66ffd9e5 66511->66513 66514 66ffdada 66511->66514 66519 66ffda38 66511->66519 66512->66514 66515 67000940 VirtualProtect 66512->66515 66513->66507 66513->66509 66566 66fe44e0 12 API calls 66513->66566 66567 66ffe3a0 memcpy malloc 66513->66567 66514->66428 66517 66ffdb0c 66515->66517 66517->66428 66518 66fff2c0 9 API calls 66518->66519 66519->66511 66519->66513 66519->66518 66564 66fff490 UnmapViewOfFile GetLastError _errno 66519->66564 66565 66fec5a0 6 API calls 66519->66565 66523 66fdd1b5 66522->66523 66525 66f93bbe 66522->66525 66526 66ffde00 malloc 66523->66526 66525->66360 66528 66fdd170 malloc 66527->66528 66529 66fdf9e5 66528->66529 66529->66459 66529->66460 66530->66488 66538 66fdf7a0 66531->66538 66534 66fdd170 malloc 66535 66fe0db1 66534->66535 66541 66fe06e0 66535->66541 66539 66fdd170 malloc 66538->66539 66540 66fdf7ad 66539->66540 66540->66534 66542 66fe06fd 66541->66542 66544 66fe0705 66541->66544 66542->66544 66545 66fe00a0 abort 66542->66545 66544->66426 66545->66544 66547 6700094a 66546->66547 66548 67000976 VirtualProtect 66547->66548 66549 6700098e 66547->66549 66548->66549 66549->66512 66551 66fff2da 66550->66551 66552 66fff317 _errno 66551->66552 66554 66fff478 66551->66554 66553 66fff3e0 _errno 66552->66553 66555 66fff32f 66552->66555 66556 66fff3ef 66553->66556 66555->66553 66557 66fff342 66555->66557 66556->66505 66558 66fff444 _get_osfhandle 66557->66558 66559 66fff353 CreateFileMappingA 66557->66559 66558->66559 66560 66fff45e _errno 66558->66560 66561 66fff3b8 GetLastError _errno 66559->66561 66562 66fff383 MapViewOfFile CloseHandle 66559->66562 66560->66556 66561->66505 66562->66556 66562->66561 66563->66511 66564->66519 66565->66519 66566->66513 66567->66513

                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                          Function 66F86560 Relevance: 118.2, APIs: 51, Strings: 16, Instructions: 911librarystringloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PySys_GetObject.PYTHON38 ref: 66F86581
                                                                                                                                                                                                          • PyTuple_GetItem.PYTHON38 ref: 66F8659B
                                                                                                                                                                                                          • PyLong_AsLong.PYTHON38 ref: 66F865B0
                                                                                                                                                                                                          • PyTuple_GetItem.PYTHON38 ref: 66F865C0
                                                                                                                                                                                                          • PyLong_AsLong.PYTHON38 ref: 66F865CE
                                                                                                                                                                                                          • PySys_GetObject.PYTHON38 ref: 66F865DD
                                                                                                                                                                                                          • PyLong_AsVoidPtr.PYTHON38 ref: 66F865E9
                                                                                                                                                                                                          • GetProcAddress.KERNEL32 ref: 66F8660E
                                                                                                                                                                                                          • GetProcAddress.KERNEL32 ref: 66F8662C
                                                                                                                                                                                                          • GetProcAddress.KERNEL32 ref: 66F8664A
                                                                                                                                                                                                          • PyModule_Create2.PYTHON38 ref: 66F86674
                                                                                                                                                                                                          • PyModule_GetName.PYTHON38 ref: 66F86689
                                                                                                                                                                                                          • strrchr.MSVCRT ref: 66F866AE
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F866C4
                                                                                                                                                                                                          • memcpy.MSVCRT ref: 66F866DE
                                                                                                                                                                                                          • PyBytes_FromStringAndSize.PYTHON38 ref: 66F86731
                                                                                                                                                                                                          • PyBytes_AsString.PYTHON38 ref: 66F8674B
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F8675F
                                                                                                                                                                                                          • PyCFunction_NewEx.PYTHON38 ref: 66F867AA
                                                                                                                                                                                                          • PyCFunction_NewEx.PYTHON38 ref: 66F867ED
                                                                                                                                                                                                          • PyCFunction_NewEx.PYTHON38 ref: 66F86830
                                                                                                                                                                                                          • PyBytes_FromStringAndSize.PYTHON38 ref: 66F8685A
                                                                                                                                                                                                          • PyBytes_AsString.PYTHON38 ref: 66F86870
                                                                                                                                                                                                          • _time64.MSVCRT ref: 66F8694D
                                                                                                                                                                                                          • srand.MSVCRT ref: 66F86955
                                                                                                                                                                                                          • strstr.MSVCRT ref: 66F86AFC
                                                                                                                                                                                                          • strncmp.MSVCRT ref: 66F86B38
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F86BAB
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F86BDA
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F86BE9
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F86C0A
                                                                                                                                                                                                          • free.MSVCRT ref: 66F86C74
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F86C80
                                                                                                                                                                                                          • memcpy.MSVCRT ref: 66F86CA3
                                                                                                                                                                                                          • free.MSVCRT ref: 66F86CD2
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F86CDE
                                                                                                                                                                                                          • memcpy.MSVCRT ref: 66F86D01
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F87348
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9D973
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9D990
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9D9B2
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9D9D2
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9D9F2
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9DA12
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9DA32
                                                                                                                                                                                                            • Part of subcall function 66F9D940: memcmp.MSVCRT ref: 66F9DA52
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D6E3
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D703
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D725
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D745
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D765
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D785
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D7A5
                                                                                                                                                                                                            • Part of subcall function 66F9D6B0: memcmp.MSVCRT ref: 66F9D7C5
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D10B
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D135
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D154
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D173
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D192
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D1AD
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D1C8
                                                                                                                                                                                                            • Part of subcall function 66F9D0E0: strcmp.MSVCRT ref: 66F9D1E3
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D3AB
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D3CF
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D3EB
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D40A
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D429
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D444
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D45F
                                                                                                                                                                                                            • Part of subcall function 66F9D380: strcmp.MSVCRT ref: 66F9D47A
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D25B
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D285
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D2A4
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D2C3
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D2E2
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D2FD
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D318
                                                                                                                                                                                                            • Part of subcall function 66F9D230: strcmp.MSVCRT ref: 66F9D333
                                                                                                                                                                                                          • PyBytes_AsStringAndSize.PYTHON38 ref: 66F86E78
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strcmp$memcmp$Bytes_Stringmalloc$AddressFunction_Long_ProcSizememcpy$DeallocErr_FormatFromItemLongModule_ObjectSys_Tuple_free$Create2NameVoid_time64srandstrncmpstrrchrstrstr
                                                                                                                                                                                                          • String ID: %s (%d:%d)$,*$.pyarmor.ikey$000000$C_ASSERT_ARMORED_INDEX$C_ENTER_CO_OBJECT_INDEX$C_LEAVE_CO_OBJECT_INDEX$PyCell_Get$PyCell_New$PyCell_Set$aes$dllhandle$pyarmor_runtime_$sha256$sprng$version_info
                                                                                                                                                                                                          • API String ID: 1610873308-3717260241
                                                                                                                                                                                                          • Opcode ID: 8ace705db764757fec76ecfa4cca4fd90099bd285529a006ed0375af6e3566cd
                                                                                                                                                                                                          • Instruction ID: ba0671170f199a6fcd344bc9cd6982eca266d08f77bade4080d707d4ab4488c4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ace705db764757fec76ecfa4cca4fd90099bd285529a006ed0375af6e3566cd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E820F72719B84C2EB01CB26E84435D3BB2FB49B88F8580AAEE5D0B794DF39E555C350
                                                                                                                                                                                                          Function 66F87560 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 467COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 559 66f87560-66f87584 560 66f8758a-66f8758d 559->560 561 66f878d0-66f878e8 call 66ffe970 559->561 562 66f87950-66f8795a 560->562 563 66f87593-66f875a3 560->563 570 66f878ee-66f878f8 561->570 571 66f879c0-66f879d4 call 66fff0c0 561->571 566 66f87b90-66f87b97 562->566 567 66f87960-66f8796c 562->567 568 66f875a9-66f875af 563->568 569 66f87a20-66f87a2a 563->569 584 66f87ba0-66f87baa 566->584 572 66f87d4b-66f87d56 exit 567->572 573 66f87972-66f87985 call 66f813c0 567->573 576 66f87680-66f8768e 568->576 577 66f875b5-66f875b7 568->577 574 66f87a30-66f87a3c 569->574 575 66f87c13-66f87c1a 569->575 581 66f878fe-66f8790a 570->581 582 66f87d00-66f87d07 570->582 571->570 598 66f879da-66f879e9 call 66ffe9d0 571->598 607 66f8798b-66f879ad PyErr_Format 573->607 608 66f87b00-66f87b07 573->608 574->572 586 66f87a42-66f87a55 call 66f813c0 574->586 588 66f87c22-66f87c29 575->588 576->577 583 66f87694-66f876a2 576->583 579 66f875b9-66f875c5 577->579 580 66f87622-66f87626 577->580 579->584 589 66f875cb-66f875db malloc 579->589 594 66f8762c-66f8764b call 66f8e850 580->594 595 66f87a90-66f87a9a 580->595 581->572 590 66f87910-66f8791d call 66f9db90 581->590 604 66f87d0f-66f87d16 582->604 583->580 591 66f876a8 583->591 592 66f87c5e-66f87c68 584->592 593 66f87bb0-66f87bb6 584->593 618 66f87a5b-66f87a7d PyErr_Format 586->618 619 66f87c04-66f87c0b 586->619 610 66f87c31-66f87c3b 588->610 599 66f87cec-66f87cf5 PyErr_NoMemory 589->599 600 66f875e1-66f875ed call 66f93b60 589->600 623 66f87923-66f87945 PyErr_Format 590->623 624 66f87cd5-66f87cdc 590->624 591->579 605 66f87bb9-66f87bbc 592->605 593->605 616 66f87665-66f87676 594->616 626 66f8764d-66f87653 594->626 601 66f87b80-66f87b8a 595->601 602 66f87aa0-66f87aa6 595->602 598->570 637 66f879ef-66f87a0a call 66ffeca0 598->637 599->616 630 66f875f3-66f8760f call 66f93b90 600->630 631 66f87ce4-66f87ce7 free 600->631 612 66f87aa9-66f87aac 601->612 602->612 628 66f87d1e-66f87d25 604->628 605->572 617 66f87bc2-66f87bd5 call 66f813c0 605->617 607->571 625 66f87b10-66f87b1a 608->625 620 66f87b55-66f87b73 PyErr_Format 610->620 612->572 622 66f87ab2-66f87ac5 call 66f813c0 612->622 646 66f87c4f-66f87c59 617->646 647 66f87bd7-66f87bde 617->647 618->595 619->575 620->616 622->588 650 66f87acb-66f87aed PyErr_Format 622->650 623->562 624->631 633 66f87c40-66f87c47 625->633 634 66f87b20-66f87b2c 625->634 635 66f87659-66f8765b 626->635 636 66f878b3-66f878c6 memset 626->636 645 66f87d2d-66f87d37 628->645 649 66f87614-66f87617 630->649 631->599 633->646 634->572 641 66f87b32-66f87b45 call 66f813c0 634->641 642 66f87880-66f8788d PyEval_GetFrame 635->642 643 66f87661-66f87663 635->643 636->643 648 66f878cc 636->648 637->570 662 66f87a10 637->662 641->610 666 66f87b4b-66f87b52 641->666 642->625 655 66f87893-66f8789c 642->655 643->616 653 66f876b0-66f876b9 PyEval_GetFrame 643->653 656 66f87cb2-66f87cd0 PyErr_Format 645->656 651 66f87be1-66f87bff PyErr_Format 646->651 647->651 648->642 657 66f87c6d-66f87c77 649->657 658 66f8761d 649->658 650->608 651->616 660 66f876bf-66f876c4 653->660 661 66f87813-66f8781d 653->661 655->625 663 66f878a2-66f878a8 655->663 656->616 664 66f87d3c-66f87d46 657->664 665 66f87c7d-66f87c83 657->665 658->580 668 66f876d5-66f876dc 660->668 661->628 667 66f87823-66f8782f 661->667 662->569 663->616 669 66f878ae 663->669 670 66f87c86-66f87c89 664->670 665->670 666->620 667->572 671 66f87835-66f87848 call 66f813c0 667->671 672 66f876de-66f876e1 668->672 673 66f876d0-66f876d3 668->673 669->653 670->572 674 66f87c8f-66f87ca2 call 66f813c0 670->674 671->604 683 66f8784e-66f87876 PyErr_Format 671->683 672->661 676 66f876e7-66f876ee 672->676 673->668 673->672 674->645 687 66f87ca8-66f87caf 674->687 679 66f876f0-66f876f4 676->679 680 66f87733-66f8773a 676->680 679->680 684 66f876f6-66f87705 679->684 680->661 681 66f87740-66f87747 680->681 685 66f87749-66f8774d 681->685 686 66f87793-66f87798 681->686 683->616 684->680 688 66f87707-66f87712 684->688 685->686 689 66f8774f-66f8775e 685->689 690 66f877a0-66f877b6 686->690 687->656 688->616 691 66f87718-66f8771e 688->691 689->686 692 66f87760-66f8776b 689->692 690->690 693 66f877b8-66f877bb 690->693 694 66f8772e-66f87731 691->694 692->616 696 66f87771-66f87777 692->696 693->661 697 66f877bd-66f877c4 693->697 694->680 695 66f87720-66f87728 694->695 695->616 695->694 698 66f8778e-66f87791 696->698 697->661 699 66f877c6-66f877ca 697->699 698->686 700 66f87780-66f87788 698->700 699->661 701 66f877cc-66f877db 699->701 700->616 700->698 701->661 702 66f877dd-66f877e8 701->702 702->616 703 66f877ee-66f877f4 702->703 704 66f8780e-66f87811 703->704 704->661 705 66f87800-66f87808 704->705 705->616 705->704
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format$malloc
                                                                                                                                                                                                          • String ID: %s (%d:%d)
                                                                                                                                                                                                          • API String ID: 1817594650-1595188566
                                                                                                                                                                                                          • Opcode ID: 4ac074a4df80c3886279f237d81a6164cce285b2daffb49a8b902e7caa7da149
                                                                                                                                                                                                          • Instruction ID: 96287a0bb9e6e5ee956589da3d6ccc4c4a0de0d61f7620510b31cfad1f860c96
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ac074a4df80c3886279f237d81a6164cce285b2daffb49a8b902e7caa7da149
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E0299B2B19B4082FF15CB2AD48472D3772EB56B88F94459ACE2D0B7A1DF39E150C760
                                                                                                                                                                                                          Function 00007FF654CA1154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _initterm$_amsg_exit_cexitexit
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 602970348-4108050209
                                                                                                                                                                                                          • Opcode ID: 6d6abd2140eb0b7f68bb3c504690dcf92132bdf22886463ef4a851639e3c59bc
                                                                                                                                                                                                          • Instruction ID: 4612fabad723a35932750a26ade81000d56b3253715170873d3ec5c8c1b4e406
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d6abd2140eb0b7f68bb3c504690dcf92132bdf22886463ef4a851639e3c59bc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8B6194A5F09B0689FB009B96E8E436833B0BB84B84F4844B6DE5DE77A5DE3CE4418750
                                                                                                                                                                                                          Function 66F85850 Relevance: 63.3, APIs: 30, Strings: 6, Instructions: 326COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 221 66f85850-66f8587f 223 66f858bd-66f858c6 call 66f87560 221->223 224 66f85881-66f858a1 221->224 228 66f858cb-66f858d1 223->228 225 66f858a4 call 66f8f750 224->225 227 66f858a9-66f858ac 225->227 229 66f858b2-66f858b9 227->229 230 66f862f5-66f86308 call 66f880b0 227->230 231 66f854b0-66f854cf PyEval_GetFrame 228->231 232 66f858d7-66f858dd 228->232 229->223 230->231 249 66f8634c-66f8636e exit 230->249 236 66f854d1-66f854e8 PyUnicode_FromFormat 231->236 237 66f85542 231->237 233 66f858e3-66f858e5 232->233 234 66f85aa6-66f85aae 232->234 239 66f858f8-66f8591c PyUnicode_AsUTF8 233->239 240 66f858e7-66f858f2 233->240 234->233 241 66f85ab4-66f85abd PyEval_GetFrame 234->241 236->237 243 66f854ea-66f854f9 Py_DecRef 236->243 238 66f85544-66f85556 237->238 247 66f85938-66f85952 PyImport_GetModuleDict PyDict_GetItem 239->247 248 66f8591e-66f85936 239->248 240->239 244 66f86179-66f86183 240->244 245 66f85ac3-66f85ae0 241->245 246 66f86286-66f8628a 241->246 243->238 255 66f86189-66f86195 244->255 256 66f862e6-66f862ed 244->256 245->233 250 66f85ae6-66f85af1 245->250 246->233 251 66f8597d-66f8599f PyImport_ExecCodeModuleObject PyErr_Occurred 247->251 252 66f85954-66f85977 PyModule_GetDict PyDict_GetItemString 247->252 248->247 248->251 253 66f86374-66f8637e 249->253 254 66f86485-66f8648c 249->254 250->233 251->231 259 66f859a5-66f859a9 251->259 252->251 258 66f860c5-66f860d7 PyEval_EvalCode 252->258 260 66f864a4-66f864ab 253->260 261 66f86384-66f8638e 253->261 255->249 257 66f8619b-66f861ae call 66f813c0 255->257 256->230 279 66f861b4-66f861d9 PyErr_Format 257->279 280 66f862d7-66f862de 257->280 269 66f854fb-66f8551a PyEval_GetFrame 258->269 270 66f860dd-66f860fc Py_DecRef Py_IncRef 258->270 262 66f859ab-66f859b8 259->262 263 66f859bc-66f859c9 259->263 267 66f864ad-66f864b7 260->267 268 66f86490-66f8649f call 66f8f870 260->268 264 66f863ac-66f863bb call 66f93b50 261->264 265 66f86390-66f863aa call 66f93b80 free 261->265 262->263 263->238 282 66f863bd free 264->282 283 66f863c2-66f863cc 264->283 265->264 267->265 276 66f864bd 267->276 268->260 269->237 271 66f8551c-66f85533 PyUnicode_FromFormat 269->271 270->238 271->237 277 66f85535-66f8553c Py_DecRef 271->277 276->264 277->237 279->231 280->256 282->283 284 66f863ce free 283->284 285 66f863d3-66f863dd 283->285 284->285 286 66f863df free 285->286 287 66f863e4-66f863eb 285->287 286->287 288 66f863ed free 287->288 289 66f863f2-66f863fc 287->289 288->289 290 66f86408-66f8640f 289->290 291 66f863fe-66f86402 289->291 292 66f8641b-66f86425 290->292 293 66f86411-66f86415 290->293 291->290 294 66f864c2-66f864cf _Py_Dealloc 291->294 296 66f86431-66f86438 292->296 297 66f86427-66f8642b 292->297 293->292 295 66f864e0-66f864f0 _Py_Dealloc 293->295 294->293 298 66f864d5 294->298 295->297 301 66f864f6 295->301 296->254 300 66f8643a-66f86440 296->300 297->296 299 66f86500-66f8650d _Py_Dealloc 297->299 298->292 299->300 302 66f86513 299->302 303 66f8644c-66f86453 300->303 304 66f86442-66f86446 300->304 301->296 302->254 306 66f8645f-66f86466 303->306 307 66f86455-66f86459 303->307 304->303 305 66f86530-66f8653a _Py_Dealloc 304->305 305->303 309 66f86468-66f8646c 306->309 310 66f86472-66f86479 306->310 307->306 308 66f86550-66f8655a _Py_Dealloc 307->308 308->306 309->310 311 66f86540-66f8654a _Py_Dealloc 309->311 310->254 312 66f8647b-66f8647f 310->312 311->310 312->254 313 66f86520-66f86527 _Py_Dealloc 312->313 313->305
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyEval_GetFrame.PYTHON38 ref: 66F854C2
                                                                                                                                                                                                          • PyUnicode_FromFormat.PYTHON38 ref: 66F854DF
                                                                                                                                                                                                          • Py_DecRef.PYTHON38 ref: 66F854F3
                                                                                                                                                                                                          • PyUnicode_AsUTF8.PYTHON38 ref: 66F85904
                                                                                                                                                                                                          • PyImport_GetModuleDict.PYTHON38 ref: 66F85938
                                                                                                                                                                                                          • PyDict_GetItem.PYTHON38 ref: 66F85946
                                                                                                                                                                                                          • PyModule_GetDict.PYTHON38 ref: 66F85957
                                                                                                                                                                                                          • PyDict_GetItemString.PYTHON38 ref: 66F8596A
                                                                                                                                                                                                          • PyImport_ExecCodeModuleObject.PYTHON38 ref: 66F8598D
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F85996
                                                                                                                                                                                                            • Part of subcall function 66F8F750: VirtualAlloc.KERNEL32 ref: 66F8F7A9
                                                                                                                                                                                                            • Part of subcall function 66F8F750: memcpy.MSVCRT ref: 66F8F7CC
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DictDict_Import_ItemModuleUnicode_$AllocCodeErr_Eval_ExecFormatFrameFromModule_ObjectOccurredStringVirtualmemcpy
                                                                                                                                                                                                          • String ID: $%s (%d:%d)$<frozen %U>$__main__$__mp_main__$__spec__
                                                                                                                                                                                                          • API String ID: 3240200909-2782528897
                                                                                                                                                                                                          • Opcode ID: db3bbc8ce2dc25059c250b18394c3a52027a2ee373e96a4f4f185882a6659b56
                                                                                                                                                                                                          • Instruction ID: 94d5e87fc850224974b9346cbd144078ae336d07e205854aaf8dd14c89593fa8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: db3bbc8ce2dc25059c250b18394c3a52027a2ee373e96a4f4f185882a6659b56
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5CD1AA32B1AB80C6FF058F66E8643687771FB89F99F0845AADA6E07725DF29C054C350
                                                                                                                                                                                                          Function 00007FF654CA3680 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 314 7ff654ca3680-7ff654ca36b6 call 7ff654cae230 318 7ff654ca38f1-7ff654ca38fd call 7ff654ca2cd0 314->318 319 7ff654ca36bc-7ff654ca36ce 314->319 323 7ff654ca3902-7ff654ca390e call 7ff654ca2cd0 318->323 319->323 324 7ff654ca36d4-7ff654ca36d8 319->324 333 7ff654ca3913-7ff654ca3938 323->333 326 7ff654ca36de-7ff654ca36e5 324->326 327 7ff654ca37d0 324->327 330 7ff654ca3708-7ff654ca370c 326->330 328 7ff654ca37d2-7ff654ca37e5 327->328 331 7ff654ca370e-7ff654ca3752 call 7ff654ca1af0 call 7ff654ca30b0 330->331 332 7ff654ca36f0-7ff654ca3702 call 7ff654ca1ab0 330->332 343 7ff654ca37e6-7ff654ca37ed call 7ff654ca2cd0 331->343 344 7ff654ca3758-7ff654ca3798 331->344 332->327 332->330 341 7ff654ca3a6e-7ff654ca3a7a 333->341 342 7ff654ca393e-7ff654ca3959 333->342 352 7ff654ca3a7f-7ff654ca3a81 341->352 350 7ff654ca395f-7ff654ca3983 342->350 351 7ff654ca3a60-7ff654ca3a67 342->351 349 7ff654ca37f2-7ff654ca37f7 343->349 362 7ff654ca37f9-7ff654ca3811 call 7ff654ca2cd0 344->362 363 7ff654ca379a-7ff654ca37bf 344->363 349->328 350->352 356 7ff654ca3989-7ff654ca3a27 350->356 351->341 354 7ff654ca3a48-7ff654ca3a5b 352->354 354->351 356->352 384 7ff654ca3a29-7ff654ca3a3b 356->384 362->349 371 7ff654ca37c1-7ff654ca37c9 free 363->371 372 7ff654ca3813-7ff654ca3869 363->372 371->332 381 7ff654ca3876-7ff654ca3897 call 7ff654ca2230 372->381 382 7ff654ca386b-7ff654ca3873 _strdup 372->382 381->333 390 7ff654ca3899-7ff654ca38c0 _strdup 381->390 382->381 384->354 388 7ff654ca3a3d-7ff654ca3a45 _strdup 384->388 388->354 392 7ff654ca38c9-7ff654ca38ec call 7ff654ca2b10 free * 2 390->392 392->328
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                          • API String ID: 1294909896-4198433784
                                                                                                                                                                                                          • Opcode ID: 12c52ad3206ff2ca4a686c2b5d6f2d74fd5d28bb8a815d9899b5b4b4f58fce32
                                                                                                                                                                                                          • Instruction ID: a12c2918d72dbe00be560d38cb66e38bb3fa5c46d70aec42375497fa29625e06
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12c52ad3206ff2ca4a686c2b5d6f2d74fd5d28bb8a815d9899b5b4b4f58fce32
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5B105A5A09A0A85EA04DB57E8B41792370BFC9FC5F8844B3DD1EA77B1EE3CE4059700
                                                                                                                                                                                                          Function 66F85861 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 217COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 395 66f85861-66f85865 396 66f85e59-66f85e63 395->396 397 66f85867-66f85870 395->397 398 66f85e69-66f85e75 396->398 399 66f860a0-66f860a7 396->399 400 66f8587b-66f8587f 397->400 401 66f85872-66f85879 397->401 404 66f85e7b-66f85e8e call 66f813c0 398->404 405 66f8634c-66f8636e exit 398->405 399->405 402 66f858bd-66f858c6 call 66f87560 400->402 403 66f85881-66f858a4 call 66f8f750 400->403 401->400 406 66f85860 401->406 413 66f858cb-66f858d1 402->413 412 66f858a9-66f858ac 403->412 423 66f86091-66f86098 404->423 424 66f85e94-66f85eb3 PyErr_Format 404->424 410 66f86374-66f8637e 405->410 411 66f86485-66f8648c 405->411 406->395 415 66f864a4-66f864ab 410->415 416 66f86384-66f8638e 410->416 419 66f858b2-66f858b9 412->419 420 66f862f5-66f86308 call 66f880b0 412->420 421 66f854b0-66f854cf PyEval_GetFrame 413->421 422 66f858d7-66f858dd 413->422 425 66f864ad-66f864b7 415->425 426 66f86490-66f8649f call 66f8f870 415->426 417 66f863ac-66f863bb call 66f93b50 416->417 418 66f86390-66f863aa call 66f93b80 free 416->418 444 66f863bd free 417->444 445 66f863c2-66f863cc 417->445 418->417 419->402 420->405 420->421 434 66f854d1-66f854e8 PyUnicode_FromFormat 421->434 435 66f85542 421->435 430 66f858e3-66f858e5 422->430 431 66f85aa6-66f85aae 422->431 423->399 424->423 425->418 433 66f864bd 425->433 426->415 439 66f858f8-66f8591c PyUnicode_AsUTF8 430->439 440 66f858e7-66f858f2 430->440 431->430 441 66f85ab4-66f85abd PyEval_GetFrame 431->441 433->417 434->435 443 66f854ea-66f854f9 Py_DecRef 434->443 437 66f85544-66f85556 435->437 449 66f85938-66f85952 PyImport_GetModuleDict PyDict_GetItem 439->449 450 66f8591e-66f85936 439->450 440->439 446 66f86179-66f86183 440->446 447 66f85ac3-66f85ae0 441->447 448 66f86286-66f8628a 441->448 443->437 444->445 451 66f863ce free 445->451 452 66f863d3-66f863dd 445->452 456 66f86189-66f86195 446->456 457 66f862e6-66f862ed 446->457 447->430 453 66f85ae6-66f85af1 447->453 448->430 454 66f8597d-66f8599f PyImport_ExecCodeModuleObject PyErr_Occurred 449->454 455 66f85954-66f85977 PyModule_GetDict PyDict_GetItemString 449->455 450->449 450->454 451->452 459 66f863df free 452->459 460 66f863e4-66f863eb 452->460 453->430 454->421 462 66f859a5-66f859a9 454->462 455->454 461 66f860c5-66f860d7 PyEval_EvalCode 455->461 456->405 458 66f8619b-66f861ae call 66f813c0 456->458 457->420 477 66f861b4-66f861d9 PyErr_Format 458->477 478 66f862d7-66f862de 458->478 459->460 466 66f863ed free 460->466 467 66f863f2-66f863fc 460->467 468 66f854fb-66f8551a PyEval_GetFrame 461->468 469 66f860dd-66f860fc Py_DecRef Py_IncRef 461->469 463 66f859ab-66f859b8 462->463 464 66f859bc-66f859c9 462->464 463->464 464->437 466->467 472 66f86408-66f8640f 467->472 473 66f863fe-66f86402 467->473 468->435 470 66f8551c-66f85533 PyUnicode_FromFormat 468->470 469->437 470->435 476 66f85535-66f8553c Py_DecRef 470->476 474 66f8641b-66f86425 472->474 475 66f86411-66f86415 472->475 473->472 479 66f864c2-66f864cf _Py_Dealloc 473->479 481 66f86431-66f86438 474->481 482 66f86427-66f8642b 474->482 475->474 480 66f864e0-66f864f0 _Py_Dealloc 475->480 476->435 477->421 478->457 479->475 483 66f864d5 479->483 480->482 486 66f864f6 480->486 481->411 485 66f8643a-66f86440 481->485 482->481 484 66f86500-66f8650d _Py_Dealloc 482->484 483->474 484->485 487 66f86513 484->487 488 66f8644c-66f86453 485->488 489 66f86442-66f86446 485->489 486->481 487->411 491 66f8645f-66f86466 488->491 492 66f86455-66f86459 488->492 489->488 490 66f86530-66f8653a _Py_Dealloc 489->490 490->488 494 66f86468-66f8646c 491->494 495 66f86472-66f86479 491->495 492->491 493 66f86550-66f8655a _Py_Dealloc 492->493 493->491 494->495 496 66f86540-66f8654a _Py_Dealloc 494->496 495->411 497 66f8647b-66f8647f 495->497 496->495 497->411 498 66f86520-66f86527 _Py_Dealloc 497->498 498->490
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyUnicode_AsUTF8.PYTHON38 ref: 66F85904
                                                                                                                                                                                                          • PyImport_GetModuleDict.PYTHON38 ref: 66F85938
                                                                                                                                                                                                          • PyDict_GetItem.PYTHON38 ref: 66F85946
                                                                                                                                                                                                          • PyModule_GetDict.PYTHON38 ref: 66F85957
                                                                                                                                                                                                          • PyDict_GetItemString.PYTHON38 ref: 66F8596A
                                                                                                                                                                                                          • PyImport_ExecCodeModuleObject.PYTHON38 ref: 66F8598D
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F85996
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DictDict_Import_ItemModule$CodeErr_ExecModule_ObjectOccurredStringUnicode_
                                                                                                                                                                                                          • String ID: $%s (%d:%d)$__main__$__mp_main__$__spec__
                                                                                                                                                                                                          • API String ID: 4088344453-4025645406
                                                                                                                                                                                                          • Opcode ID: 513e9e035e8bfa4f1a755c1bbacd14e2794831eec675c11f6f24c33b77d09f19
                                                                                                                                                                                                          • Instruction ID: 91b9f1b8619ca420024f8a307cfd60020474cd34f91eac12201592baaf686658
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 513e9e035e8bfa4f1a755c1bbacd14e2794831eec675c11f6f24c33b77d09f19
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC81AC32B16B8086FF55CF66E8A03697371EB85B99F4845AADE6E07B15DF29C041C310
                                                                                                                                                                                                          Function 00007FF654CA5550 Relevance: 28.6, APIs: 2, Strings: 17, Instructions: 140COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$EnvironmentVariable
                                                                                                                                                                                                          • String ID: %s%c%s%c%s%c%s%c%s$;$;$C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone$C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                                                                                                                                                                                          • API String ID: 471908985-2295976025
                                                                                                                                                                                                          • Opcode ID: c48456801aa9cd7d8cc58aca705c0cba2a25958533fc06219b0b3206e7b935ed
                                                                                                                                                                                                          • Instruction ID: c5265b3b3413d4e9f1c6cb2bef02cd0de2cf1d92495f50b3756175d3fd4c8a5b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c48456801aa9cd7d8cc58aca705c0cba2a25958533fc06219b0b3206e7b935ed
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3613EA5E19A1685FA149B12E8F42B92370AFC4B84F8C80B3D94EF77A5DF2CE545C704
                                                                                                                                                                                                          Function 00007FF654CA1710 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 198fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 706 7ff654ca1710-7ff654ca177d call 7ff654ca8ae0 709 7ff654ca1783-7ff654ca1793 malloc 706->709 710 7ff654ca19fb-7ff654ca1a13 call 7ff654ca2cd0 706->710 711 7ff654ca1799-7ff654ca17a9 malloc 709->711 712 7ff654ca1a5a-7ff654ca1a71 call 7ff654ca2e50 709->712 724 7ff654ca1a18-7ff654ca1a36 710->724 715 7ff654ca17af 711->715 716 7ff654ca1a3b-7ff654ca1a4d call 7ff654ca2e50 711->716 721 7ff654ca1a52 712->721 719 7ff654ca17b3-7ff654ca17d5 fread 715->719 716->721 722 7ff654ca18f5 719->722 723 7ff654ca17db-7ff654ca17e5 ferror 719->723 721->712 726 7ff654ca18fa-7ff654ca1927 call 7ff654caa970 free * 2 722->726 723->722 725 7ff654ca17eb-7ff654ca1805 723->725 727 7ff654ca1990-7ff654ca1998 724->727 729 7ff654ca1808-7ff654ca1824 call 7ff654ca8b90 725->729 728 7ff654ca1893-7ff654ca1895 727->728 728->729 731 7ff654ca189b-7ff654ca18b5 728->731 738 7ff654ca18d0-7ff654ca18d3 729->738 739 7ff654ca182a-7ff654ca182d 729->739 734 7ff654ca1a73-7ff654ca1a75 731->734 735 7ff654ca18bb-7ff654ca18be 731->735 734->726 735->719 737 7ff654ca18c4-7ff654ca18cc 735->737 737->726 740 7ff654ca18ce 737->740 741 7ff654ca1833-7ff654ca184c 738->741 742 7ff654ca18d9-7ff654ca18dc 738->742 739->741 743 7ff654ca1930-7ff654ca1936 739->743 744 7ff654ca18e2-7ff654ca18f0 call 7ff654ca2cd0 740->744 745 7ff654ca1940-7ff654ca1949 741->745 746 7ff654ca1852-7ff654ca1874 fwrite 741->746 742->744 743->744 744->722 745->728 750 7ff654ca194f-7ff654ca1953 745->750 748 7ff654ca187a-7ff654ca1889 ferror 746->748 749 7ff654ca19ed-7ff654ca19f6 746->749 748->749 751 7ff654ca188f 748->751 749->744 752 7ff654ca19a0-7ff654ca19eb 750->752 753 7ff654ca1955-7ff654ca1959 750->753 751->728 752->727 753->724 754 7ff654ca195f-7ff654ca1962 753->754 754->727 755 7ff654ca1964-7ff654ca1975 754->755 755->727 756 7ff654ca1977-7ff654ca198b 755->756 756->727
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc$ferrorfree$freadfwrite
                                                                                                                                                                                                          • String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$_MEIPASS2$malloc
                                                                                                                                                                                                          • API String ID: 1635854594-2461342963
                                                                                                                                                                                                          • Opcode ID: 5d83aac17ced31a7c1805e244f49a19b62b07cc991f9975bd614b182ebb2c88a
                                                                                                                                                                                                          • Instruction ID: dedc42404c983bce25259a1f689a528bbd32b3ea96a0acd360ce2955a4666e2d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5d83aac17ced31a7c1805e244f49a19b62b07cc991f9975bd614b182ebb2c88a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A28195A6A0C69181E720CB26E4A03AA63B0FFC47A4F984172DEDDA77D5DE7CD485C700
                                                                                                                                                                                                          Function 00007FF654CAE5E0 Relevance: 25.9, APIs: 17, Instructions: 353COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 757 7ff654cae5e0-7ff654cae60d call 7ff654cb8578 760 7ff654cae61f-7ff654cae638 setlocale 757->760 761 7ff654cae60f-7ff654cae61b _strdup 757->761 762 7ff654cae63e-7ff654cae647 760->762 763 7ff654caea6b-7ff654caeae1 wcstombs realloc wcstombs setlocale free 760->763 761->760 762->763 764 7ff654cae64d-7ff654cae6f2 mbstowcs call 7ff654cae230 mbstowcs 762->764 765 7ff654caeae8-7ff654caeaf4 763->765 768 7ff654cae6f4-7ff654cae6ff 764->768 769 7ff654cae75b-7ff654cae760 764->769 770 7ff654cae701-7ff654cae70c 768->770 771 7ff654cae70e-7ff654cae723 768->771 772 7ff654cae762-7ff654cae771 769->772 773 7ff654cae77b-7ff654cae785 769->773 770->769 770->771 774 7ff654cae725-7ff654cae733 771->774 775 7ff654cae77a 771->775 772->773 776 7ff654cae773-7ff654cae778 772->776 777 7ff654caea61-7ff654caea64 773->777 778 7ff654cae78b-7ff654cae79b 773->778 774->775 779 7ff654cae735-7ff654cae756 setlocale free 774->779 775->773 776->773 777->763 780 7ff654cae7f1-7ff654cae7fb 778->780 781 7ff654caea66-7ff654caea69 779->781 782 7ff654cae79d-7ff654cae7a8 780->782 783 7ff654cae7fd 780->783 781->765 785 7ff654cae7be-7ff654cae7c9 782->785 786 7ff654cae7aa-7ff654cae7b5 782->786 784 7ff654cae800-7ff654cae808 783->784 791 7ff654cae80f-7ff654cae81c 784->791 792 7ff654cae80a-7ff654cae9b3 784->792 789 7ff654cae7b9 785->789 790 7ff654cae7cb-7ff654cae7d6 785->790 787 7ff654cae7b7 786->787 788 7ff654cae7ec 786->788 787->785 788->780 789->785 790->789 793 7ff654cae7d8-7ff654cae7e2 790->793 795 7ff654cae81e-7ff654cae829 791->795 796 7ff654cae838-7ff654cae840 791->796 801 7ff654cae9b5-7ff654cae9c0 792->801 802 7ff654cae9c2-7ff654cae9c7 792->802 799 7ff654cae7ff 793->799 800 7ff654cae7e4-7ff654cae7e8 793->800 795->791 803 7ff654cae82b-7ff654cae836 795->803 797 7ff654cae842-7ff654cae84d 796->797 798 7ff654cae89a-7ff654cae8b0 796->798 804 7ff654cae84f-7ff654cae85a 797->804 805 7ff654cae85c-7ff654cae871 797->805 806 7ff654cae8b7-7ff654cae8c2 798->806 799->784 800->788 801->802 807 7ff654cae9c9-7ff654cae9d5 801->807 808 7ff654cae9da-7ff654caea39 wcstombs realloc wcstombs 802->808 803->791 803->796 804->798 804->805 805->798 809 7ff654cae873-7ff654cae882 805->809 810 7ff654cae8c4-7ff654cae8cf 806->810 811 7ff654cae8b2 806->811 807->808 812 7ff654caea3e-7ff654caea5f setlocale free 808->812 809->798 813 7ff654cae884-7ff654cae893 809->813 810->811 814 7ff654cae8d1-7ff654cae8dd 810->814 811->806 812->781 813->798 815 7ff654cae895 813->815 816 7ff654cae8df-7ff654cae8f1 814->816 817 7ff654cae8f3-7ff654cae8f7 814->817 815->798 816->817 818 7ff654cae8fb-7ff654cae903 816->818 817->818 819 7ff654cae95a-7ff654cae964 818->819 820 7ff654cae905-7ff654cae922 819->820 821 7ff654cae966-7ff654cae98f wcstombs 819->821 823 7ff654cae940-7ff654cae94b 820->823 824 7ff654cae924-7ff654cae937 820->824 821->812 822 7ff654cae995-7ff654cae9a3 821->822 822->812 826 7ff654cae94d-7ff654cae958 823->826 827 7ff654cae93b 823->827 824->819 825 7ff654cae939 824->825 825->823 826->819 826->827 827->823
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 918573998-0
                                                                                                                                                                                                          • Opcode ID: a83cf2a6e7cdc1dd5fd551beaeb6a114339be945ac12246f5548f53177ceeab4
                                                                                                                                                                                                          • Instruction ID: f4cd77e1830dbf52755837107e1a0d5ee60df2f5d932de03dbce69b9c962df6c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a83cf2a6e7cdc1dd5fd551beaeb6a114339be945ac12246f5548f53177ceeab4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9CF140A6F04B1588FB509BAAC4912BC37B0FB85B88F884476DE4CA7799DF38D451C360
                                                                                                                                                                                                          Function 00007FF654CA1E80 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 144COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freadmalloc$fcloseferrorfree
                                                                                                                                                                                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 1320676746-1463511288
                                                                                                                                                                                                          • Opcode ID: 11665d2b36410fafcdd0b93d8076e27d90fdf4b13ae36a9fc73be4023cf48d23
                                                                                                                                                                                                          • Instruction ID: babdc14d796f17458553065fe2034b09e9d09d4541117d9d885cdfc4dc8efd52
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11665d2b36410fafcdd0b93d8076e27d90fdf4b13ae36a9fc73be4023cf48d23
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91514DB2B0961296EA18CB16D5E027967B1BFC8744F888077DA0E97B95DF3DE4A1C700
                                                                                                                                                                                                          Function 66FFF2C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 870 66fff2c0-66fff2d8 871 66fff2da-66fff2ec 870->871 872 66fff312-66fff315 870->872 873 66fff2f2-66fff2f4 871->873 874 66fff400-66fff402 871->874 875 66fff317-66fff329 _errno 872->875 876 66fff2fa-66fff302 873->876 877 66fff420-66fff422 873->877 880 66fff434-66fff43f 874->880 881 66fff404-66fff415 874->881 878 66fff32f-66fff333 875->878 879 66fff3e0-66fff3e9 _errno 875->879 884 66fff30d-66fff310 876->884 885 66fff304-66fff30b 876->885 882 66fff478-66fff47d 877->882 883 66fff424-66fff42a 877->883 878->879 886 66fff339-66fff33c 878->886 887 66fff3ef-66fff3fe 879->887 880->875 881->875 883->880 884->875 885->875 885->884 886->879 888 66fff342-66fff34d 886->888 889 66fff444-66fff458 _get_osfhandle 888->889 890 66fff353-66fff381 CreateFileMappingA 888->890 889->890 891 66fff45e-66fff473 _errno 889->891 892 66fff3b8-66fff3da GetLastError _errno 890->892 893 66fff383-66fff3b6 MapViewOfFile CloseHandle 890->893 891->887 893->887 893->892
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File_errno$CloseCreateErrorHandleLastMappingView
                                                                                                                                                                                                          • String ID: $@$@
                                                                                                                                                                                                          • API String ID: 896588047-3743272326
                                                                                                                                                                                                          • Opcode ID: 8bce634052248ac0fe09119566a57010313dbdf8e4743f0df6502e78c6b4aa78
                                                                                                                                                                                                          • Instruction ID: e52eec593fddd049e3133b1fc536c989496648b384d660d646d9b8e591064491
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8bce634052248ac0fe09119566a57010313dbdf8e4743f0df6502e78c6b4aa78
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64412073E3665086F7914B26EC0174AA151BB8ABB8F490322DE79177F0EB3CC842C341
                                                                                                                                                                                                          Function 00007FF654CA1AF0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 103COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosefreadfreemalloc
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                          • API String ID: 3295367466-3659356012
                                                                                                                                                                                                          • Opcode ID: 9e0dd351f8b021831cc2584e7f4dd04d9fd565d43a08166a570ebe01350c0405
                                                                                                                                                                                                          • Instruction ID: 572f06128dd524eefc0dfb7737fbcec5e7b6fca825b2bf5b9956e42b6949d000
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e0dd351f8b021831cc2584e7f4dd04d9fd565d43a08166a570ebe01350c0405
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4031CEE2B0965655FB059B12E8B06BA2374AF847D8FCC40B3DD0DA6791EE3CE549C300
                                                                                                                                                                                                          Function 00007FF654CA16D0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 285stringCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 927 7ff654ca16d0-7ff654ca3b83 call 7ff654ca8160 call 7ff654cae230 call 7ff654ca21b0 935 7ff654ca3b89-7ff654ca3b9c call 7ff654ca42f0 927->935 936 7ff654ca3f38 927->936 935->936 940 7ff654ca3ba2-7ff654ca3bb7 call 7ff654ca4380 935->940 939 7ff654ca3f40-7ff654ca3f4f call 7ff654ca5ee0 936->939 945 7ff654ca3f5f-7ff654ca3f73 call 7ff654ca6310 call 7ff654ca61b0 939->945 946 7ff654ca3f51-7ff654ca3f5d call 7ff654ca6100 939->946 940->936 948 7ff654ca3bbd-7ff654ca3bd2 call 7ff654ca4370 940->948 961 7ff654ca3f80-7ff654ca3f90 call 7ff654ca20b0 945->961 946->945 955 7ff654ca3fd8-7ff654ca3fe5 call 7ff654ca6430 946->955 948->936 958 7ff654ca3bd8-7ff654ca3bed call 7ff654ca6fe0 948->958 963 7ff654ca3fea-7ff654ca3ff5 fclose 955->963 965 7ff654ca3d50-7ff654ca3d68 call 7ff654ca70d0 call 7ff654ca20b0 958->965 966 7ff654ca3bf3-7ff654ca3c0d call 7ff654ca6fe0 958->966 972 7ff654ca3c56-7ff654ca3c8a call 7ff654ca8210 961->972 973 7ff654ca3f96 961->973 967 7ff654ca3fa6-7ff654ca3fb5 call 7ff654ca2cd0 963->967 989 7ff654ca3d6e-7ff654ca3d8e call 7ff654ca3520 965->989 990 7ff654ca3f10-7ff654ca3f20 call 7ff654ca20b0 965->990 980 7ff654ca3c0f-7ff654ca3c15 966->980 981 7ff654ca3c38-7ff654ca3c49 call 7ff654ca70d0 call 7ff654ca20b0 966->981 967->936 992 7ff654ca3c90-7ff654ca3c99 SetDllDirectoryW call 7ff654ca6170 972->992 993 7ff654ca3ff7-7ff654ca4003 call 7ff654ca2cd0 972->993 978 7ff654ca3f26-7ff654ca3f33 call 7ff654ca2cd0 973->978 978->936 986 7ff654ca3f00 980->986 987 7ff654ca3c1b-7ff654ca3c33 free call 7ff654ca70d0 980->987 1001 7ff654ca3c4e-7ff654ca3c50 981->1001 986->990 987->981 1005 7ff654ca3e3e-7ff654ca3e43 call 7ff654ca6170 989->1005 1006 7ff654ca3d94-7ff654ca3d99 989->1006 990->978 1004 7ff654ca3da8-7ff654ca3dbd call 7ff654ca43b0 990->1004 1003 7ff654ca3c9e-7ff654ca3ca9 992->1003 993->936 1001->961 1001->972 1007 7ff654ca3caf-7ff654ca3cb4 call 7ff654ca61b0 1003->1007 1008 7ff654ca3e48-7ff654ca3e58 call 7ff654ca5cc0 1003->1008 1018 7ff654ca3fa0 1004->1018 1019 7ff654ca3dc3-7ff654ca3e10 call 7ff654ca7d30 1004->1019 1005->1008 1006->1004 1016 7ff654ca3cb9-7ff654ca3cc6 strcmp 1007->1016 1008->939 1017 7ff654ca3e5e-7ff654ca3e6b call 7ff654ca61b0 1008->1017 1020 7ff654ca3cc8-7ff654ca3ceb call 7ff654ca3b20 1016->1020 1021 7ff654ca3d0a-7ff654ca3d15 call 7ff654ca3a90 call 7ff654ca3aa0 1016->1021 1017->1016 1032 7ff654ca3e71-7ff654ca3e80 call 7ff654ca3580 1017->1032 1018->967 1019->963 1033 7ff654ca3e16-7ff654ca3e38 call 7ff654ca3520 1019->1033 1020->936 1030 7ff654ca3cf1-7ff654ca3d05 strcpy 1020->1030 1034 7ff654ca3d1a-7ff654ca3d33 call 7ff654ca3b00 call 7ff654ca6310 call 7ff654ca61b0 1021->1034 1030->1021 1032->936 1041 7ff654ca3e86-7ff654ca3e90 1032->1041 1033->1005 1033->1006 1050 7ff654ca3d38-7ff654ca3d4d 1034->1050 1043 7ff654ca3e92 1041->1043 1044 7ff654ca3e99-7ff654ca3eac call 7ff654ca7070 call 7ff654ca79b0 1041->1044 1043->1044 1044->936 1052 7ff654ca3eb2-7ff654ca3ee5 call 7ff654ca3b10 call 7ff654ca79c0 call 7ff654ca6310 call 7ff654ca61b0 1044->1052 1061 7ff654ca3fc0-7ff654ca3fcc call 7ff654ca7490 1052->1061 1062 7ff654ca3eeb-7ff654ca3ef3 call 7ff654ca21f0 1052->1062 1061->1062 1062->1050
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$EnvironmentVariable$DirectoryFileModuleNamecallocstrcmpstrcpy
                                                                                                                                                                                                          • String ID: Cannot side-load external archive %s (code %d)!$Error opening archive ZNdewcHn8K from executable (%s) or external archive (%s)$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                          • API String ID: 4056350997-3668766296
                                                                                                                                                                                                          • Opcode ID: 5b42ffc26fe656d3dc18153cefd1910fe32b185476038c5a3808a836f78a1520
                                                                                                                                                                                                          • Instruction ID: 723f92a87f2936aa3c76af61cbceb6ba315cc9e1c360b81ee62241ca0de7e46b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b42ffc26fe656d3dc18153cefd1910fe32b185476038c5a3808a836f78a1520
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98C1A6A1A1D64250FA10DB2398B01BA6674AFC4BC4F4C40B3EE4EE7BE6DE3CE5458700
                                                                                                                                                                                                          Function 00007FF654CA57D0 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 84stringCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 1067 7ff654ca57d0-7ff654ca5813 strlen 1069 7ff654ca58f1-7ff654ca5902 call 7ff654ca2cd0 1067->1069 1070 7ff654ca5819-7ff654ca5831 1067->1070 1074 7ff654ca58e2-7ff654ca58f0 1069->1074 1075 7ff654ca58e0 1070->1075 1076 7ff654ca5837-7ff654ca584c 1070->1076 1075->1074 1077 7ff654ca5864-7ff654ca586d 1076->1077 1078 7ff654ca586f-7ff654ca5891 call 7ff654ca1af0 1077->1078 1079 7ff654ca5850-7ff654ca5862 call 7ff654ca1ab0 1077->1079 1085 7ff654ca5893-7ff654ca589a 1078->1085 1086 7ff654ca58c8-7ff654ca58d7 call 7ff654ca2cd0 1078->1086 1079->1075 1079->1077 1089 7ff654ca589f-7ff654ca58a2 1085->1089 1090 7ff654ca58a4-7ff654ca58aa 1086->1090 1089->1086 1089->1090 1092 7ff654ca58b9-7ff654ca58c1 free 1090->1092 1093 7ff654ca58ac-7ff654ca58b0 1090->1093 1092->1079 1093->1092
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freestrlen
                                                                                                                                                                                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
                                                                                                                                                                                                          • API String ID: 322734593-568040347
                                                                                                                                                                                                          • Opcode ID: 9e845a276c51c4464c120e7fb7b1e0ba1285ac3300ef2d75e6443f80687ba065
                                                                                                                                                                                                          • Instruction ID: e9478405bfe89d8356fdc044c51e20c3a9de5755dfd6bc7600f40dbc39bedd85
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e845a276c51c4464c120e7fb7b1e0ba1285ac3300ef2d75e6443f80687ba065
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9316EA1B09A4691EA149B57E8A40B96330BFC4B94F8C84B3DD1EE77A1EE3CE445D301
                                                                                                                                                                                                          Function 00007FF654CA7D30 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 1165 7ff654ca7d30-7ff654ca7d59 malloc 1166 7ff654ca7d5f-7ff654ca7d71 call 7ff654caf2c0 1165->1166 1167 7ff654ca7e20 1165->1167 1166->1167 1171 7ff654ca7d77-7ff654ca7d85 call 7ff654caf3b0 1166->1171 1169 7ff654ca7e22-7ff654ca7e3d free 1167->1169 1171->1167 1174 7ff654ca7d8b-7ff654ca7d94 1171->1174 1175 7ff654ca7d99-7ff654ca7db3 1174->1175 1175->1167 1176 7ff654ca7db5-7ff654ca7dc5 call 7ff654caf2c0 1175->1176 1176->1167 1179 7ff654ca7dc7-7ff654ca7dd5 call 7ff654cb8500 1176->1179 1181 7ff654ca7dda-7ff654ca7ddd 1179->1181 1181->1167 1182 7ff654ca7ddf-7ff654ca7de8 1181->1182 1183 7ff654ca7e0a-7ff654ca7e0d 1182->1183 1184 7ff654ca7e0f-7ff654ca7e17 1183->1184 1185 7ff654ca7df0-7ff654ca7e05 call 7ff654cb8548 1183->1185 1184->1175 1187 7ff654ca7e19 1184->1187 1189 7ff654ca7e40-7ff654ca7e48 1185->1189 1190 7ff654ca7e07 1185->1190 1187->1167 1189->1169 1190->1183
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freemalloc
                                                                                                                                                                                                          • String ID: _MEIPASS2
                                                                                                                                                                                                          • API String ID: 3061335427-3944641314
                                                                                                                                                                                                          • Opcode ID: 47c5326f12971c907186fce21dcd40d8267512280e1e237bd1ecb972a3a23034
                                                                                                                                                                                                          • Instruction ID: 5b0c06c5fc477e7d01a1bfbc06f031b5b856a8db3b8c6ecb1eb4e27287fd294e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 47c5326f12971c907186fce21dcd40d8267512280e1e237bd1ecb972a3a23034
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 412108A2B0A11205FE10951399A47FAD6667F85BC4F8C0473DE0DEB7C1ED3CE942C240
                                                                                                                                                                                                          Function 00007FF654CA6170 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: calloc
                                                                                                                                                                                                          • String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                          • API String ID: 2635317215-799113134
                                                                                                                                                                                                          • Opcode ID: daeeb61d3e57278251d27ce958a3713753ff428d5e00cabe7585f6002fde9d4c
                                                                                                                                                                                                          • Instruction ID: 14d1bdee05f23941bb96d06a4412261f5947c08b2419bf668f690ed2517d87c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: daeeb61d3e57278251d27ce958a3713753ff428d5e00cabe7585f6002fde9d4c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6E0C2E1F0860680EA14AB00D4E91F92B70EFC4340FCC40B6DA5CB7BA2EE3CE5458700
                                                                                                                                                                                                          Function 00007FF654CAF300 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fsetpos
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 850078086-0
                                                                                                                                                                                                          • Opcode ID: 1b41710901f17b2eeca1497c090281577d230925116f41a5d4b4f06b87e02d06
                                                                                                                                                                                                          • Instruction ID: b104fdc5b6c141cf6f9acb5d5b09d47a2712c4bd0829fc231079b8ff7df6f3fc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b41710901f17b2eeca1497c090281577d230925116f41a5d4b4f06b87e02d06
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51114DB6A05B06C9EB10DF66C4A10BC33B0AF84798F544AB6EA1DA7799DF38D0508360
                                                                                                                                                                                                          Function 00007FF654CA20B0 Relevance: 3.0, APIs: 2, Instructions: 48stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosestrcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3396940900-0
                                                                                                                                                                                                          • Opcode ID: 189eab3eda584426b79a923873d08d7fcad8c28c9a176b0606dae0b493bfce30
                                                                                                                                                                                                          • Instruction ID: 3796415255b77e960a134fc900405ab017e41298186196f1cfaf81f32bc4ce62
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 189eab3eda584426b79a923873d08d7fcad8c28c9a176b0606dae0b493bfce30
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0118EA5B0814280FB549A72E9A53F912619FD4BC4F9C8173DD0EE778ADE2CE8C9C310
                                                                                                                                                                                                          Function 00007FF654CA7950 Relevance: 3.0, APIs: 2, Instructions: 20libraryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32 ref: 00007FF654CA7971
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA797D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharLibraryLoadMultiWidefree
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3231889924-0
                                                                                                                                                                                                          • Opcode ID: ac1678f2e02d1b72cbc567d5e7bac802729ecc80d491b3a74ede665a07012b31
                                                                                                                                                                                                          • Instruction ID: c0ab7ddcea750955aba7ef1ff668c353a1a2ec9070326e29f9057cb02cd6c640
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ac1678f2e02d1b72cbc567d5e7bac802729ecc80d491b3a74ede665a07012b31
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1FD0C741FAA1A602EE88A2672CAAABA10101F89BC0ECC8474CC0E97701EC2C80824700
                                                                                                                                                                                                          Function 00007FF654CAF1BB Relevance: 2.6, APIs: 2, Instructions: 67COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freememsetwcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2332356550-0
                                                                                                                                                                                                          • Opcode ID: 16ca566369b86500749d9f98ec16c1cf0d74b93f9dbbc66e3a29c3db3259c6e1
                                                                                                                                                                                                          • Instruction ID: 00bee5ed386922b5bf0a7c5e12d49da0a74c4ced8ab3b4f24a2bb71e0cfb6ff3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16ca566369b86500749d9f98ec16c1cf0d74b93f9dbbc66e3a29c3db3259c6e1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2231EAA6F00B1489EB10CF7AD48109C3BB1FB98BA8B148566EE1C53B6CDF34C591C790
                                                                                                                                                                                                          Function 67000940 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                          • Opcode ID: fe5837323282d315a15794c740daf0bac631d7c30206fff776a4dc5a47e3ca90
                                                                                                                                                                                                          • Instruction ID: cd783cb35b1c5ccd56b387b9dc9809c4c0e09b979c626c1b103b450ba26739f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe5837323282d315a15794c740daf0bac631d7c30206fff776a4dc5a47e3ca90
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43F01C7237D52085F6310D29D600FAA7594575BBF0E94811699BC0ABF4D55FC6818F22
                                                                                                                                                                                                          Function 00007FF654CA43B0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • _wfopen.MSVCRT ref: 00007FF654CA43F5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 372205238-0
                                                                                                                                                                                                          • Opcode ID: e249028c2137e21c272be09ebad8c35b62695eafe249120916a556fd3ad7a81d
                                                                                                                                                                                                          • Instruction ID: ce7b9c4f3f1a137ca05e3566820a6583da373b9eeb85fd7be1711753db72d2db
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e249028c2137e21c272be09ebad8c35b62695eafe249120916a556fd3ad7a81d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9E0D8D1B4C21102F9146213BD647FA92225F8AFC4F488132EF0CABB8A8D1DD243CB00
                                                                                                                                                                                                          Function 66FFD980 Relevance: 1.5, APIs: 1, Instructions: 213COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2221118986-0
                                                                                                                                                                                                          • Opcode ID: 87d80e122543ab82afe693d9a7a50df2d0bf7f3205f6cf244ec925fd0e59c24c
                                                                                                                                                                                                          • Instruction ID: cc6605d32a8233596066b01f0e67003fd64ba0751052047c5fa452c7b4720335
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 87d80e122543ab82afe693d9a7a50df2d0bf7f3205f6cf244ec925fd0e59c24c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E9197B2A29B9486EB558F26D45035D3BA0F745FECF18411ACF9D1B3A9DB38C496C380
                                                                                                                                                                                                          Function 00007FF654CACBA0 Relevance: 1.3, APIs: 1, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2221118986-0
                                                                                                                                                                                                          • Opcode ID: 623919cd236f253b3d7bc4f578d470e9102edac5acaca204977424f4e3dbef8b
                                                                                                                                                                                                          • Instruction ID: 574f1b3ce3b82e9b44adfb3d838f31a46a3e68b46195a73d1774baacd5146e6e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 623919cd236f253b3d7bc4f578d470e9102edac5acaca204977424f4e3dbef8b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E315DA6F0471599F7109BA6D4903BC37B0AB80B88F9840B6DE4CA7B98DF3CD691C750
                                                                                                                                                                                                          Function 00007FF654CA8AE0 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2803490479-0
                                                                                                                                                                                                          • Opcode ID: 0fc86e8ee51b5bdc1f5f7082c9320d3be715a44251d05dfd6912ed91f5c13a9f
                                                                                                                                                                                                          • Instruction ID: 9ced9d583d56a81cae4a990e0d4cd5c51dcbbd51bab2b6840cf302b74af97891
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fc86e8ee51b5bdc1f5f7082c9320d3be715a44251d05dfd6912ed91f5c13a9f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 722162A2A09A0247EB658B5694A033936A1AFC4B94F6D4176C91DA77D0DF39DC83C350
                                                                                                                                                                                                          Function 00007FF654CAA970 Relevance: 1.3, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1294909896-0
                                                                                                                                                                                                          • Opcode ID: 91393a4a38c2f9ca34023a88416337a771a7b0123113a7f946b122cb324d8598
                                                                                                                                                                                                          • Instruction ID: a180d695fb52b41f9e0bf69a82406a42087f8a2e0a32023fe358829ae4b58fd3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 91393a4a38c2f9ca34023a88416337a771a7b0123113a7f946b122cb324d8598
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42F01CA2A05A1182DB509B7BD89036923B0EF88FA8F191272CE4D97394EE25CC81C280
                                                                                                                                                                                                          Function 66FFDE00 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • malloc.MSVCRT(?,?,00000000,?,66FE0C70,00000000,?,?,66F93BB6,?,?,?,?,?,?), ref: 66FFDE0F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2803490479-0
                                                                                                                                                                                                          • Opcode ID: 1bf828e095ce4e9032b00840eccc91d5e23d29e85e168ad2e099bbb74118d7cc
                                                                                                                                                                                                          • Instruction ID: 8f0ba91d47a1758a7b6ac7e434d4990a1de01463283f716b81bd24b7a461b6f6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1bf828e095ce4e9032b00840eccc91d5e23d29e85e168ad2e099bbb74118d7cc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34D01266B9BA5581E50D9B573C5039895576B5EBF1F4CC0308E4D97315FC2844D34310

                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                          Function 66F93330 Relevance: 72.1, APIs: 35, Strings: 6, Instructions: 355networkstringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLast$ioctlsockettoupper$Cleanupstrstr$closesocketgethostbynamememcmp$Startup_mktime64connecthtonsrecvselectsendsocketstrchr
                                                                                                                                                                                                          • String ID: Dec$HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close$Nov$and,$http://$or,
                                                                                                                                                                                                          • API String ID: 3493847099-1714119496
                                                                                                                                                                                                          • Opcode ID: 42489d4b48dd1ba86145c690c31f5d26bf968e15ce3ea48600c44bee7116b454
                                                                                                                                                                                                          • Instruction ID: d76999b93ba649e746c1b3042c1f0762a8ca73d85845fe0afe183f76ff09b861
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42489d4b48dd1ba86145c690c31f5d26bf968e15ce3ea48600c44bee7116b454
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6FE14533A0CAD186F714CB34E44475ABBB1F389B98F048225CA6D47799EB3DC946CB51
                                                                                                                                                                                                          Function 66F945C0 Relevance: 63.4, APIs: 30, Strings: 6, Instructions: 406memorystringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Process$AdaptersAddressesAllocComputerFreeNamemallocstrlen
                                                                                                                                                                                                          • String ID: 01234567$89abcdef$:[sc$Characteristics$NetCfgInstanceId$SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
                                                                                                                                                                                                          • API String ID: 1478035857-3618987999
                                                                                                                                                                                                          • Opcode ID: 58c956fca055b189b8c71f584b7d8aadf6d42f2ceb1ac7bde637e8721036a808
                                                                                                                                                                                                          • Instruction ID: 52763bc0bb4e5b6b4d8eb9910064e3114784c22fa63c2909a5e96c61abf6598c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58c956fca055b189b8c71f584b7d8aadf6d42f2ceb1ac7bde637e8721036a808
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35F18E7271978086F724CB26B84079FBBA5F79AB88F448229DF9947B58DB3DC105CB10
                                                                                                                                                                                                          Function 66F89C60 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 476COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (index list too large), xrefs: 66F8AFC5
                                                                                                                                                                                                          • EOF read where object expected, xrefs: 66F8B52F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$AppendList_OccurredString
                                                                                                                                                                                                          • String ID: EOF read where object expected$bad marshal data (index list too large)
                                                                                                                                                                                                          • API String ID: 2605687773-1134984
                                                                                                                                                                                                          • Opcode ID: d61d1595cc4b94d6aa42ff5966654c35fb5a56767a83485c02c2fa030b00a6b4
                                                                                                                                                                                                          • Instruction ID: 6d7547fbfbc69c77759aeed3a0040f8c2f9ad8ff62175bab5d84107e6ea3a4fd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d61d1595cc4b94d6aa42ff5966654c35fb5a56767a83485c02c2fa030b00a6b4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8128C33609BC486EB648F25E99835AB7B1F789B88F448959CEAD47798EF3DC014C740
                                                                                                                                                                                                          Function 00007FF654CA2560 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                          • String ID: $BUTTON$Close$EDIT$Failed to vqmkBiYr script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                          • API String ID: 3223904152-2049099994
                                                                                                                                                                                                          • Opcode ID: f946fc37740113d1f7e6e8a1de48a3746edf2e82bfe78e13903bb1f18fd90df2
                                                                                                                                                                                                          • Instruction ID: 709febca6ca9bb1fff722a10e6abc08a1bf68adee4d3bfccb26f7a8030932bae
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f946fc37740113d1f7e6e8a1de48a3746edf2e82bfe78e13903bb1f18fd90df2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB91BD76218B9082E7108F61E4A479A7770F788BC8F14413AEE8C5BB98CF7EC085CB50
                                                                                                                                                                                                          Function 66F838D6 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 418stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Deallocfreemallocmemcpystrcmp
                                                                                                                                                                                                          • String ID: %s (%d:%d)$N+
                                                                                                                                                                                                          • API String ID: 2421945241-2748867177
                                                                                                                                                                                                          • Opcode ID: bfc3ea11b4ea52dbcc71e7982e5d219b1f2feea5074215385fbb6bb86aa917be
                                                                                                                                                                                                          • Instruction ID: 4fe9b6d4a79930aaf8960c4037a2cd52bc182e7d00192f4b2d051ba766038e10
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bfc3ea11b4ea52dbcc71e7982e5d219b1f2feea5074215385fbb6bb86aa917be
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6BF1EF73708B8086EB10CF29D8903597771EB96BA9F48825ADEAD4B3A4DF3DC551C720
                                                                                                                                                                                                          Function 66F82C80 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 282librarystringloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyEval_GetGlobals.PYTHON38 ref: 66F82CE4
                                                                                                                                                                                                          • PyFunction_NewWithQualName.PYTHON38 ref: 66F82CF3
                                                                                                                                                                                                          • _PyObject_CallFunction_SizeT.PYTHON38 ref: 66F82D2F
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F82D71
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F82E4A
                                                                                                                                                                                                          • GetProcAddress.KERNEL32 ref: 66F82E6A
                                                                                                                                                                                                          • strlen.MSVCRT ref: 66F82E82
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F83147
                                                                                                                                                                                                            • Part of subcall function 66F8E850: PyList_New.PYTHON38 ref: 66F8E88A
                                                                                                                                                                                                            • Part of subcall function 66F8E850: PyMem_Free.PYTHON38 ref: 66F8E8C3
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F82F99
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F82FAD
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F82FD9
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83003
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83013
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_FormatFunction_$AddressCallEval_FreeGlobalsList_Mem_NameObject_ProcQualSizeWithstrlen
                                                                                                                                                                                                          • String ID: %s (%d:%d)$/proc/se$lf/exe$z(
                                                                                                                                                                                                          • API String ID: 4028440157-3850701646
                                                                                                                                                                                                          • Opcode ID: 67a44e418211ee00871a3260e99db8160e0c740df772b11043ac3c43ae521917
                                                                                                                                                                                                          • Instruction ID: 1d5f0c56159bfd8c29402811fbe73bd13ba8b0652e1ed453e53b4d81596bbc18
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 67a44e418211ee00871a3260e99db8160e0c740df772b11043ac3c43ae521917
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DB1AC73B18A80C6FB008B69D8883583772EB9AF98F84415ADD6D077A5CF2EC641C790
                                                                                                                                                                                                          Function 66F91E90 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _snprintf.MSVCRT ref: 66F91EDC
                                                                                                                                                                                                          • CreateFileA.KERNEL32 ref: 66F91F10
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32 ref: 66F91F2A
                                                                                                                                                                                                          • DeviceIoControl.KERNEL32 ref: 66F91FA4
                                                                                                                                                                                                          • GlobalFree.KERNEL32 ref: 66F91FBA
                                                                                                                                                                                                          • _snprintf.MSVCRT ref: 66F91FF7
                                                                                                                                                                                                          • CreateFileA.KERNEL32 ref: 66F92024
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32 ref: 66F92045
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32 ref: 66F92054
                                                                                                                                                                                                          • DeviceIoControl.KERNEL32 ref: 66F9209C
                                                                                                                                                                                                          • GlobalFree.KERNEL32 ref: 66F920B5
                                                                                                                                                                                                          • GlobalFree.KERNEL32 ref: 66F920BA
                                                                                                                                                                                                          • CloseHandle.KERNEL32 ref: 66F920C4
                                                                                                                                                                                                          • GlobalFree.KERNEL32 ref: 66F920E6
                                                                                                                                                                                                            • Part of subcall function 66F91B40: GetLastError.KERNEL32 ref: 66F91B44
                                                                                                                                                                                                            • Part of subcall function 66F91B40: FormatMessageA.KERNEL32 ref: 66F91B75
                                                                                                                                                                                                            • Part of subcall function 66F91B40: LocalFree.KERNEL32 ref: 66F91B96
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
                                                                                                                                                                                                          • String ID: ../src/platforms/windows/hdinfo.c$/%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d
                                                                                                                                                                                                          • API String ID: 1119308327-3953537554
                                                                                                                                                                                                          • Opcode ID: 07e4e21e60358c920845821d35dbe081e418f415c29be2bf8939be607358a8d9
                                                                                                                                                                                                          • Instruction ID: 743f16cc10964eb205508d7efd5a5b80e6e6cf0190e5cffddc76ef5be1137caf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 07e4e21e60358c920845821d35dbe081e418f415c29be2bf8939be607358a8d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0051B13231868486F7509B22F81875ABB66F788BE8F444225DE6D07BD4DF3EC5498750
                                                                                                                                                                                                          Function 66F93050 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 149networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLast$Cleanup$closesocketntohlsetsockopt$Startupgethostbynamehtonsrecvfromsendtosocket
                                                                                                                                                                                                          • String ID: and,$http://$or,
                                                                                                                                                                                                          • API String ID: 1750001962-2642771825
                                                                                                                                                                                                          • Opcode ID: f5621a20867676ab835add618566f5f6156720f60fa33ed51b47ff061c77da8f
                                                                                                                                                                                                          • Instruction ID: 76cd5265e4e4398ad14c20c019bad0c1345411464435ddc19e23acca00ac1282
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f5621a20867676ab835add618566f5f6156720f60fa33ed51b47ff061c77da8f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9515D3260968086F7108B65F80835AB7A1F789BB8F140328EABC47BE5DF7DC548CB40
                                                                                                                                                                                                          Function 66F89AA0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 179COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (unnormalized long data), xrefs: 66F8AFA4
                                                                                                                                                                                                          • bad marshal data (long size out of range), xrefs: 66F8AEDF
                                                                                                                                                                                                          • bad marshal data (digit out of range in long), xrefs: 66F8ADF4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Occurred$Long_String$Dealloc
                                                                                                                                                                                                          • String ID: bad marshal data (digit out of range in long)$bad marshal data (long size out of range)$bad marshal data (unnormalized long data)
                                                                                                                                                                                                          • API String ID: 3848820501-2912230410
                                                                                                                                                                                                          • Opcode ID: 5bc338cac9ccb4e0e947c84c94b1f62be5f405781a060c7ef0a2f9ef0408a9cc
                                                                                                                                                                                                          • Instruction ID: 2ef7eec8fe95fd10496c1c059d5dfcc07b6e1d8c586d8b73495f33b13aab8365
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5bc338cac9ccb4e0e947c84c94b1f62be5f405781a060c7ef0a2f9ef0408a9cc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11617E33709690CBFA04CF28C45C72A37B6FB89B89F469498C92A57354DF3AD646C390
                                                                                                                                                                                                          Function 66F90832 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 159COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • exceptions must derive from BaseException, xrefs: 66F90861
                                                                                                                                                                                                          • exception causes must derive from BaseException, xrefs: 66F908CA
                                                                                                                                                                                                          • calling %R should have returned an instance of BaseException, not %R, xrefs: 66F90ADA
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_String
                                                                                                                                                                                                          • String ID: calling %R should have returned an instance of BaseException, not %R$exception causes must derive from BaseException$exceptions must derive from BaseException
                                                                                                                                                                                                          • API String ID: 1450464846-2865718950
                                                                                                                                                                                                          • Opcode ID: 4a023e350da011ab2ad22bf4473dd0211eaa449f9ae131f9e8648b057b904b9f
                                                                                                                                                                                                          • Instruction ID: febf28f8a3a747cff02bb30bad1b68555ae802a840ee94888f8f698ed6fa540b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a023e350da011ab2ad22bf4473dd0211eaa449f9ae131f9e8648b057b904b9f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70519333B48A44C6FB098F2AE9583297362B785FD8F484128CE6D07725DFB9C155C390
                                                                                                                                                                                                          Function 66F92240 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
                                                                                                                                                                                                          • String ID: /%d:$\\.\PhysicalDrive%d
                                                                                                                                                                                                          • API String ID: 2355516209-72258043
                                                                                                                                                                                                          • Opcode ID: 33d7d6228dc422a040bcb7331baf9b637b32cd73d9d028aaf22a700db3a584d4
                                                                                                                                                                                                          • Instruction ID: 07286e8b0068f2c44d44e269f31427a47554ecf7652daa96c44c477022c3a46f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 33d7d6228dc422a040bcb7331baf9b637b32cd73d9d028aaf22a700db3a584d4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 09514B7362C68086F701CB36E84475FBB92BB86798F444215EEA947B99DB7EC14CCB10
                                                                                                                                                                                                          Function 66FA43A0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Cryptclock$Context$Acquire$RandomRelease
                                                                                                                                                                                                          • String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
                                                                                                                                                                                                          • API String ID: 2525729555-3762154145
                                                                                                                                                                                                          • Opcode ID: 793d620e323749c494c65408393a792c2461284f5025dbfa7414b8457e5158e6
                                                                                                                                                                                                          • Instruction ID: 79d166363c91b5acaa4023ffb375a2610c9bf038cbaf023096194428447e26ec
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 793d620e323749c494c65408393a792c2461284f5025dbfa7414b8457e5158e6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB31EF32718B80C6F710CF6AB84434ABBA6B789B98F404421DE4983764EF7AC486C361
                                                                                                                                                                                                          Function 66FFF770 Relevance: 12.0, APIs: 8, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RtlCaptureContext.KERNEL32 ref: 66FFF784
                                                                                                                                                                                                          • RtlLookupFunctionEntry.KERNEL32 ref: 66FFF79B
                                                                                                                                                                                                          • RtlVirtualUnwind.KERNEL32 ref: 66FFF7DD
                                                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32 ref: 66FFF821
                                                                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32 ref: 66FFF82E
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32 ref: 66FFF834
                                                                                                                                                                                                          • TerminateProcess.KERNEL32 ref: 66FFF842
                                                                                                                                                                                                          • abort.MSVCRT ref: 66FFF848
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4278921479-0
                                                                                                                                                                                                          • Opcode ID: f288b9e1baaae890ae0828b563388bd0882b53e54600ca77df703d032c6bcad7
                                                                                                                                                                                                          • Instruction ID: 470fadc75d9850c4d6deed3dcb911b30c4929598db38c774f759f90e21840ba5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f288b9e1baaae890ae0828b563388bd0882b53e54600ca77df703d032c6bcad7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4821167221DB04D5FB008B65F88439933BAB70CB9CF844126D95E13725EF39C265C760
                                                                                                                                                                                                          Function 00007FFDFB133EA4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 280COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Fiber$ErrorLastSwitch$CreateValuememmove
                                                                                                                                                                                                          • String ID: *$..\s\crypto\async\async.c
                                                                                                                                                                                                          • API String ID: 3019965278-1471988776
                                                                                                                                                                                                          • Opcode ID: 45e357ca4cf0a53423c2a2d7082731b4d95f49ecae19fd680e47bbb8d304c6ef
                                                                                                                                                                                                          • Instruction ID: 1865e777cc8ed7815df5cb3aabdf46075316fa90fabd26817f3154cda1fbd141
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 45e357ca4cf0a53423c2a2d7082731b4d95f49ecae19fd680e47bbb8d304c6ef
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98C16C72B0AB4386EB20EB22E4609A977A0FF44B48F544435EA6D477E9EF3CE555C340
                                                                                                                                                                                                          Function 66F83AC1 Relevance: 7.7, APIs: 5, Instructions: 240COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 2aa7f4218ea1f66b95b148c455017a003c0d2cfb5ffa9dfc77694273e211ec8d
                                                                                                                                                                                                          • Instruction ID: de437f0f8149d4e54606e9ccbd6c3f5a7e9f9801fc98892e3a7ee448a4cfdc98
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2aa7f4218ea1f66b95b148c455017a003c0d2cfb5ffa9dfc77694273e211ec8d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A3A105737149D9A7CB02CF69D00019FBBB1F706B0EB99C049EB5A4A122D732D95BC751
                                                                                                                                                                                                          Function 66FFF690 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSystemTimeAsFileTime.KERNEL32 ref: 66FFF6D5
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32 ref: 66FFF6E0
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 66FFF6E9
                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 66FFF6F1
                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32 ref: 66FFF6FE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1445889803-0
                                                                                                                                                                                                          • Opcode ID: f40b1da27bc48723bde3b5c45379760af47dace5d55662387a80838995845961
                                                                                                                                                                                                          • Instruction ID: a18b87706231706de217299e19b4846ccdfb428762e38bff72ff2597060366ad
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f40b1da27bc48723bde3b5c45379760af47dace5d55662387a80838995845961
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74114F3B669A1086FB504B35F808319A262B7487B8F085730DD6C437B4EE3DC59AC710
                                                                                                                                                                                                          Function 00007FF654CA6100 Relevance: 166.6, APIs: 31, Strings: 64, Instructions: 348libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc$LibraryLoadfree
                                                                                                                                                                                                          • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                          • API String ID: 4213687213-1453502826
                                                                                                                                                                                                          • Opcode ID: 1c815d3e7de6c3911d1ed5474632c0ec2993e8d45509a061944c3f9f4ef79aaf
                                                                                                                                                                                                          • Instruction ID: 973cf5e1eb3db5a902a6e7c684a0dc43147a4d93fd2fd0fd87dbf93562d895e1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c815d3e7de6c3911d1ed5474632c0ec2993e8d45509a061944c3f9f4ef79aaf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0202E3E4E0AB0790EA55DB15F9F40B427B4AFC4380B8C94B7C44EA77A5EE6CE54AC310
                                                                                                                                                                                                          Function 66F928C0 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 436filestringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F928FE
                                                                                                                                                                                                            • Part of subcall function 66F92510: strlen.MSVCRT ref: 66F92533
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F92937
                                                                                                                                                                                                            • Part of subcall function 66F92730: strlen.MSVCRT ref: 66F9274A
                                                                                                                                                                                                          • fputc.MSVCRT ref: 66F92969
                                                                                                                                                                                                            • Part of subcall function 66F91BB0: GetProcessHeap.KERNEL32 ref: 66F91BD3
                                                                                                                                                                                                            • Part of subcall function 66F91BB0: HeapAlloc.KERNEL32 ref: 66F91BE7
                                                                                                                                                                                                            • Part of subcall function 66F91BB0: GetAdaptersAddresses.IPHLPAPI ref: 66F91C0C
                                                                                                                                                                                                            • Part of subcall function 66F91BB0: GetProcessHeap.KERNEL32 ref: 66F91C7F
                                                                                                                                                                                                            • Part of subcall function 66F91BB0: HeapFree.KERNEL32 ref: 66F91C89
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F92998
                                                                                                                                                                                                            • Part of subcall function 66F919C0: GetProcessHeap.KERNEL32 ref: 66F919E1
                                                                                                                                                                                                            • Part of subcall function 66F919C0: HeapAlloc.KERNEL32 ref: 66F919F6
                                                                                                                                                                                                            • Part of subcall function 66F919C0: memcpy.MSVCRT ref: 66F91A6C
                                                                                                                                                                                                            • Part of subcall function 66F919C0: GetProcessHeap.KERNEL32 ref: 66F91A8A
                                                                                                                                                                                                            • Part of subcall function 66F919C0: HeapFree.KERNEL32 ref: 66F91A95
                                                                                                                                                                                                          • fputc.MSVCRT ref: 66F929CB
                                                                                                                                                                                                            • Part of subcall function 66F91D40: GetProcessHeap.KERNEL32 ref: 66F91D63
                                                                                                                                                                                                            • Part of subcall function 66F91D40: HeapAlloc.KERNEL32 ref: 66F91D77
                                                                                                                                                                                                            • Part of subcall function 66F91D40: GetAdaptersAddresses.IPHLPAPI ref: 66F91D9F
                                                                                                                                                                                                            • Part of subcall function 66F91D40: inet_ntoa.WS2_32 ref: 66F91DD7
                                                                                                                                                                                                            • Part of subcall function 66F91D40: GetProcessHeap.KERNEL32 ref: 66F91DF2
                                                                                                                                                                                                            • Part of subcall function 66F91D40: HeapFree.KERNEL32 ref: 66F91DFC
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F929FA
                                                                                                                                                                                                          • fputc.MSVCRT ref: 66F92A0E
                                                                                                                                                                                                            • Part of subcall function 66F92140: GetProcessHeap.KERNEL32 ref: 66F9215B
                                                                                                                                                                                                            • Part of subcall function 66F92140: HeapAlloc.KERNEL32 ref: 66F9216F
                                                                                                                                                                                                            • Part of subcall function 66F92140: GetNetworkParams.IPHLPAPI ref: 66F921A7
                                                                                                                                                                                                            • Part of subcall function 66F92140: GetProcessHeap.KERNEL32 ref: 66F921C9
                                                                                                                                                                                                            • Part of subcall function 66F92140: HeapFree.KERNEL32 ref: 66F921D3
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F92A3D
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92A5E
                                                                                                                                                                                                          • strchr.MSVCRT ref: 66F92A8B
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92AC3
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F92AEB
                                                                                                                                                                                                          • strchr.MSVCRT ref: 66F92AF8
                                                                                                                                                                                                          • fprintf.MSVCRT ref: 66F92B19
                                                                                                                                                                                                          • fputc.MSVCRT ref: 66F92B32
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92B53
                                                                                                                                                                                                          • malloc.MSVCRT ref: 66F92B5D
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92EF7
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92F18
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92F39
                                                                                                                                                                                                          • fwrite.MSVCRT ref: 66F92F5A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Failed to get domain name., xrefs: 66F92F45
                                                                                                                                                                                                          • %02x:, xrefs: 66F92E0E
                                                                                                                                                                                                          • Default Mac address: "%s", xrefs: 66F9298B
                                                                                                                                                                                                          • Hardware informations got by PyArmor:, xrefs: 66F928E6
                                                                                                                                                                                                          • Failed to get ip address., xrefs: 66F92F24
                                                                                                                                                                                                          • Serial number of default harddisk: "%s", xrefs: 66F9292A
                                                                                                                                                                                                          • >", xrefs: 66F92EB7
                                                                                                                                                                                                          • Domain name: "%s", xrefs: 66F92A30
                                                                                                                                                                                                          • Serial number with disk name: , xrefs: 66F92AAE
                                                                                                                                                                                                          • Ip address: "%s", xrefs: 66F929ED
                                                                                                                                                                                                          • Failed to get mac address., xrefs: 66F92F03
                                                                                                                                                                                                          • Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 66F92A49
                                                                                                                                                                                                          • "%s", xrefs: 66F92ACD, 66F92B0C
                                                                                                                                                                                                          • Multiple Mac addresses: "<, xrefs: 66F92B3E
                                                                                                                                                                                                          • %02x, xrefs: 66F92E6D
                                                                                                                                                                                                          • Failed to get harddisk information., xrefs: 66F92EE2
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Processfwrite$fprintf$AllocFreefputc$AdaptersAddressesstrchrstrlen$NetworkParamsinet_ntoamallocmemcpy
                                                                                                                                                                                                          • String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
                                                                                                                                                                                                          • API String ID: 3427000353-3771683696
                                                                                                                                                                                                          • Opcode ID: eb22b472ff73d2eda26802c2464a32e64e5a8e708135cba05a01e7ada9dbe044
                                                                                                                                                                                                          • Instruction ID: 2efac3af79a9896d73cabf1364f0e988bc7123ea9ccfc99ada51f737d46b5b68
                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb22b472ff73d2eda26802c2464a32e64e5a8e708135cba05a01e7ada9dbe044
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43029D36329B848AFB50CB25E45439E77A6F789BA8F008226DF9D47798DF3AC144C711
                                                                                                                                                                                                          Function 66F833ED Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 171COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyImport_GetModuleDict.PYTHON38 ref: 66F833ED
                                                                                                                                                                                                          • PyDict_GetItemString.PYTHON38 ref: 66F83400
                                                                                                                                                                                                          • PyModule_GetDict.PYTHON38 ref: 66F8340E
                                                                                                                                                                                                          • PyDict_GetItemString.PYTHON38 ref: 66F83427
                                                                                                                                                                                                          • PyObject_GetAttrString.PYTHON38 ref: 66F8344D
                                                                                                                                                                                                          • PyList_GetItem.PYTHON38 ref: 66F83461
                                                                                                                                                                                                          • _PyObject_CallFunction_SizeT.PYTHON38 ref: 66F834A6
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F834D7
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F834E9
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F834F5
                                                                                                                                                                                                          • PyErr_Clear.PYTHON38 ref: 66F83580
                                                                                                                                                                                                          • getenv.MSVCRT ref: 66F8358D
                                                                                                                                                                                                          • PyUnicode_FromFormat.PYTHON38(?,?,?,?,?,?), ref: 66F835AA
                                                                                                                                                                                                          • _PyObject_CallFunction_SizeT.PYTHON38(?,?,?,?,?,?), ref: 66F835D7
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F83605
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F83617
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83623
                                                                                                                                                                                                          • PyList_GetItem.PYTHON38 ref: 66F83685
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83824
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object_$CallSize$ItemMethod_$DeallocString$DictDict_Function_List_$AttrClearErr_FormatFromImport_ModuleModule_Unicode_getenv
                                                                                                                                                                                                          • String ID: %U/%s$%U/../%s$%s/%s$PYARMOR_RKEY$__path__$_path$close$read
                                                                                                                                                                                                          • API String ID: 2543034039-1237617226
                                                                                                                                                                                                          • Opcode ID: e1b016914b5e7b6b87f589857cac34d34ac1e87f9f39a1f90c3dcef8a817df11
                                                                                                                                                                                                          • Instruction ID: 41add89dbbe9bf8f26cbe69c37cb58bea8ea31a311c0844cf22015d33ce1c5e7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e1b016914b5e7b6b87f589857cac34d34ac1e87f9f39a1f90c3dcef8a817df11
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73618D7375AA10C5FE05DBAAEC0835523A2BB49B98F88546ACC1D07331EF3EC959C320
                                                                                                                                                                                                          Function 66F88290 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 203COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • %U.%U, xrefs: 66F88442
                                                                                                                                                                                                          • cannot import name %R from %R (%S), xrefs: 66F884FA
                                                                                                                                                                                                          • cannot import name %R from %R (unknown location), xrefs: 66F883B5
                                                                                                                                                                                                          • cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S), xrefs: 66F88515
                                                                                                                                                                                                          • <unknown module name>, xrefs: 66F88368
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AttrErr_Object_Tuple_$ClearDeallocErrorFilenameFromImportLookupModule_ObjectSizeStringUnicode_
                                                                                                                                                                                                          • String ID: %U.%U$<unknown module name>$cannot import name %R from %R (%S)$cannot import name %R from %R (unknown location)$cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S)
                                                                                                                                                                                                          • API String ID: 597108667-3215622635
                                                                                                                                                                                                          • Opcode ID: 0b636d72b52868ff50777b4f11f57c09960b1768b104a63cbea96283873e2f0c
                                                                                                                                                                                                          • Instruction ID: 6a1bef322f754a089a92e14643885b679f49611553ac64e985aa3a23e200488b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b636d72b52868ff50777b4f11f57c09960b1768b104a63cbea96283873e2f0c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 84717D33B19B84E6EA049F26E85875A63B5B78AFD8F480069DD6E07725DF3DC254C310
                                                                                                                                                                                                          Function 66F8D390 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 453fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwrite$Err_Py_hashtable_get_entryString
                                                                                                                                                                                                          • String ID: too many objects
                                                                                                                                                                                                          • API String ID: 3930244777-4209268247
                                                                                                                                                                                                          • Opcode ID: fa090c08b0fb60d478c04ae38b7f57fd07667f6f36716c4d4720667f9f138815
                                                                                                                                                                                                          • Instruction ID: 3445bb55771246d038600982ed6e33b8494ebfa53518db68460a91c6272470a6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa090c08b0fb60d478c04ae38b7f57fd07667f6f36716c4d4720667f9f138815
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F128DB2614B8086EB04CFA9E05439977B1FB49FE8F50422BDA5E5B798DF38C591C390
                                                                                                                                                                                                          Function 66F91060 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • missing required positional arguments, xrefs: 66F911A1
                                                                                                                                                                                                          • Can't remove argname from kwargs, xrefs: 66F91286
                                                                                                                                                                                                          • missing kwonly required arguments, xrefs: 66F9142A
                                                                                                                                                                                                          • too many positional arguments, xrefs: 66F91494
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_Err_ItemString$DeallocTuple_
                                                                                                                                                                                                          • String ID: Can't remove argname from kwargs$missing kwonly required arguments$missing required positional arguments$too many positional arguments
                                                                                                                                                                                                          • API String ID: 2174600326-1903473336
                                                                                                                                                                                                          • Opcode ID: 28cc82da182a29a76e7f28fab56373e72e4e9c72db14733914b3ecd1a03fffa2
                                                                                                                                                                                                          • Instruction ID: 39f5c187b5645ac5abdba47f8c7c0571aa516d8d23a9755a5d76dc16f8cc622d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 28cc82da182a29a76e7f28fab56373e72e4e9c72db14733914b3ecd1a03fffa2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 00B14932619B84D2FB25CF25E84435A7379F79ABA8F558221CEAD43B68CF39C095C710
                                                                                                                                                                                                          Function 66F8FC70 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 175COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • not enough values to unpack (expected %d, got %d), xrefs: 66F8FEAD
                                                                                                                                                                                                          • cannot unpack non-iterable %.200s object, xrefs: 66F8FE7F
                                                                                                                                                                                                          • too many values to unpack (expected %d), xrefs: 66F8FDDF
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Dealloc$FormatIter_NextOccurred$CheckExceptionIterMatchesObject_Sequence_
                                                                                                                                                                                                          • String ID: cannot unpack non-iterable %.200s object$not enough values to unpack (expected %d, got %d)$too many values to unpack (expected %d)
                                                                                                                                                                                                          • API String ID: 4253435814-2953850414
                                                                                                                                                                                                          • Opcode ID: 4ae758f1f6122f153df45a04735c8f5d02a2d18b035e85410d30d0ce1831f0bc
                                                                                                                                                                                                          • Instruction ID: bb78d9aa872d7f79b0593d89aaf6ced5b041ff7bc4566f42d27c636bd3e8b73e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ae758f1f6122f153df45a04735c8f5d02a2d18b035e85410d30d0ce1831f0bc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F961AD33B1AA44CAEA849F29E8483186372FBD9FD9F544569CE2D47325DF39C195C320
                                                                                                                                                                                                          Function 66F89CA5 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 164COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89CB6
                                                                                                                                                                                                          • _Py_CheckFunctionResult.PYTHON38 ref: 66F8A3C0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (index list too large), xrefs: 66F8B255
                                                                                                                                                                                                          • bad marshal data (set size out of range), xrefs: 66F8AC19
                                                                                                                                                                                                          • NULL object in marshal data for set, xrefs: 66F8B042
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CheckErr_FunctionOccurredResult
                                                                                                                                                                                                          • String ID: NULL object in marshal data for set$bad marshal data (index list too large)$bad marshal data (set size out of range)
                                                                                                                                                                                                          • API String ID: 3781139737-600355161
                                                                                                                                                                                                          • Opcode ID: c8f67c40486653046e2c3ca47707ff543f13426e1b356efa78fb6efdf85ecb2c
                                                                                                                                                                                                          • Instruction ID: 464bdc2f7a25b6c66c3618ccf06e207b2930d8099563bd73cbd52f408807669e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8f67c40486653046e2c3ca47707ff543f13426e1b356efa78fb6efdf85ecb2c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7619033609A80C3FB54CB6AE44835E73B1F785BA4F418599C96E47798DF39C546C360
                                                                                                                                                                                                          Function 66F88810 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _PyFloat_Unpack8.PYTHON38 ref: 66F88841
                                                                                                                                                                                                          • PyBuffer_FillInfo.PYTHON38 ref: 66F88896
                                                                                                                                                                                                          • PyMemoryView_FromBuffer.PYTHON38 ref: 66F888A4
                                                                                                                                                                                                          • _PyObject_CallMethodId_SizeT.PYTHON38 ref: 66F888C4
                                                                                                                                                                                                          • PyNumber_AsSsize_t.PYTHON38 ref: 66F888E3
                                                                                                                                                                                                          • PyErr_SetString.PYTHON38 ref: 66F88A11
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F889E5
                                                                                                                                                                                                          • marshal data too short, xrefs: 66F88A07
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F88972
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BufferBuffer_CallErr_FillFloat_FromInfoMemoryMethodNumber_Object_SizeSsize_tStringUnpack8View_
                                                                                                                                                                                                          • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 3670709071-4172231876
                                                                                                                                                                                                          • Opcode ID: 3eca95e28352e075eee955ad36ce1df736b194464b845e13c39b76958bb8f106
                                                                                                                                                                                                          • Instruction ID: 5406d9df5b56de47d205fa6819b22a080f04a4a945e288e7c69c2a40f8f8aa95
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3eca95e28352e075eee955ad36ce1df736b194464b845e13c39b76958bb8f106
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5517832729A04D6FF05CF69E8483182372A789FA9F504369C97D137A8DF39C59AC361
                                                                                                                                                                                                          Function 00007FFDFB1366B8 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 205stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strspn$strncmp
                                                                                                                                                                                                          • String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
                                                                                                                                                                                                          • API String ID: 1384302209-3505811795
                                                                                                                                                                                                          • Opcode ID: e90065c7be01b739f3bd4072d943918714ba8c1968184f16852b7dcd88a8af2c
                                                                                                                                                                                                          • Instruction ID: a3250c143e5fb5508f899a40ad4adc88ede6996e3cdf1c329cd650b805e27ff6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e90065c7be01b739f3bd4072d943918714ba8c1968184f16852b7dcd88a8af2c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6591B265B0F65786E7249F11E434ABD77A1AF08B88F844030CA6D86AEDEF3DE546C700
                                                                                                                                                                                                          Function 00007FF654CA1C80 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 123COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$fclose$freadfreemallocstrcpystrtok
                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                          • API String ID: 790192563-666925554
                                                                                                                                                                                                          • Opcode ID: 0650b55fdc532a3c314f5b9d4dd76ba0dd67bca11ed56b8b8d39f3fa91f93a94
                                                                                                                                                                                                          • Instruction ID: 5d8936f683f5ecfed94953b87fe6d7f503a50193c404997fd602b43de507e3d5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0650b55fdc532a3c314f5b9d4dd76ba0dd67bca11ed56b8b8d39f3fa91f93a94
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41419CA5F0960250FB559B22D8F02B92271AFC5B94FCC45B3DE1EAB3D2EE2CE5458300
                                                                                                                                                                                                          Function 66F88A40 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 120COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyBuffer_FillInfo.PYTHON38 ref: 66F88AC6
                                                                                                                                                                                                          • PyMemoryView_FromBuffer.PYTHON38 ref: 66F88AD4
                                                                                                                                                                                                          • _PyObject_CallMethodId_SizeT.PYTHON38 ref: 66F88AF4
                                                                                                                                                                                                          • PyNumber_AsSsize_t.PYTHON38 ref: 66F88B13
                                                                                                                                                                                                          • PyErr_SetString.PYTHON38 ref: 66F88C41
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F88C15
                                                                                                                                                                                                          • marshal data too short, xrefs: 66F88C37
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F88BA2
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BufferBuffer_CallErr_FillFromInfoMemoryMethodNumber_Object_SizeSsize_tStringView_
                                                                                                                                                                                                          • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 3120701247-4172231876
                                                                                                                                                                                                          • Opcode ID: 936f3972695df17d923b0cd6dabc38f08f1a4f489ded14f4527c1b8a5bc998e0
                                                                                                                                                                                                          • Instruction ID: 80fae3de215552da353d4150ba323bc849d43b01c92d992e7f86c9359f7a527e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 936f3972695df17d923b0cd6dabc38f08f1a4f489ded14f4527c1b8a5bc998e0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE416CB2719A44D2FE04CB69D8483082372A789FB9F944319CA3D473E5DF39C656C360
                                                                                                                                                                                                          Function 00007FF654CA7270 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 118COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wputenv_s.MSVCRT ref: 00007FF654CA72C1
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA72CC
                                                                                                                                                                                                          • GetTempPathW.KERNEL32 ref: 00007FF654CA72F0
                                                                                                                                                                                                          • _getpid.MSVCRT(?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA72F6
                                                                                                                                                                                                          • _wtempnam.MSVCRT ref: 00007FF654CA731F
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA7334
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA735E
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA6FE0: GetEnvironmentVariableW.KERNEL32 ref: 00007FF654CA700C
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF654CA714B
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: free.MSVCRT ref: 00007FF654CA7156
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: _wfullpath.MSVCRT ref: 00007FF654CA717E
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71AD
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcsncpy.MSVCRT ref: 00007FF654CA71DB
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71E5
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71F0
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7110: CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA7202
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                                                                                                                                                                                          • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                          • API String ID: 2180377646-1116378104
                                                                                                                                                                                                          • Opcode ID: 5c4b10aed0aea61ccbc9035126b4b601bd2dedeeab183b41183b05d6da6e050d
                                                                                                                                                                                                          • Instruction ID: f62146a0d111edc9aa6a38346515cddbce1d3ae4a64bb84879afd9183c586abf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c4b10aed0aea61ccbc9035126b4b601bd2dedeeab183b41183b05d6da6e050d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB415B91E4A50301FA55A723ADB56B652726FC5BD1F8C84B7EC0EE7792ED3CE4498200
                                                                                                                                                                                                          Function 66F88DA0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyBuffer_FillInfo.PYTHON38 ref: 66F88E22
                                                                                                                                                                                                          • PyMemoryView_FromBuffer.PYTHON38 ref: 66F88E34
                                                                                                                                                                                                          • _PyObject_CallMethodId_SizeT.PYTHON38 ref: 66F88E58
                                                                                                                                                                                                          • PyNumber_AsSsize_t.PYTHON38 ref: 66F88E7A
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F88E93
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F88EBE
                                                                                                                                                                                                          • PyErr_SetString.PYTHON38 ref: 66F88F81
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F88EB4
                                                                                                                                                                                                          • marshal data too short, xrefs: 66F88F77
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F88F59
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$BufferBuffer_CallFillFormatFromInfoMemoryMethodNumber_Object_OccurredSizeSsize_tStringView_
                                                                                                                                                                                                          • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 2192429850-4172231876
                                                                                                                                                                                                          • Opcode ID: 07277b65a59be4b753c614c0202c736ff9f12106d3464e1bc0326f5e957a5f6a
                                                                                                                                                                                                          • Instruction ID: bd3b84fc69c9513d84d28faa8ed2957b0cbeb0af704760227e98b37447ab39cd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 07277b65a59be4b753c614c0202c736ff9f12106d3464e1bc0326f5e957a5f6a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D41A073319A04D6FE148F66E8483596372BB58BE8F8846698E3E47760DF3DC194C360
                                                                                                                                                                                                          Function 66F8329E Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 94COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _PyObject_CallFunction_SizeT.PYTHON38 ref: 66F832E8
                                                                                                                                                                                                          • PyErr_Clear.PYTHON38 ref: 66F83304
                                                                                                                                                                                                          • PyErr_Format.PYTHON38 ref: 66F83364
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38(?,?,?,?,?,?), ref: 66F833A3
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38(?,?,?,?,?,?), ref: 66F833B5
                                                                                                                                                                                                          • PySys_GetObject.PYTHON38 ref: 66F83517
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83573
                                                                                                                                                                                                          • getenv.MSVCRT ref: 66F83647
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CallObject_Size$Err_Method_$ClearDeallocFormatFunction_ObjectSys_getenv
                                                                                                                                                                                                          • String ID: %U.%s$%U/%s$%s (%d:%d)$%s/%s$PYARMOR_RKEY$close$executable$read
                                                                                                                                                                                                          • API String ID: 2643494441-891831584
                                                                                                                                                                                                          • Opcode ID: f1e9cc0939e1be94a31a7c904e7eda209acd20ea79d6dff75c61349203f42e4d
                                                                                                                                                                                                          • Instruction ID: 0e73371ab166e256a0892b585c144ba63e4b61b50368bb7f737f8491852f140f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1e9cc0939e1be94a31a7c904e7eda209acd20ea79d6dff75c61349203f42e4d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86310173749A58C1FF01DB9AEC443592362AB49BD8F84446ACD1D07770EF2ECA12C360
                                                                                                                                                                                                          Function 66F8FF30 Relevance: 27.2, APIs: 18, Instructions: 153COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$CallCheckErr_Object_Signals
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 356930793-0
                                                                                                                                                                                                          • Opcode ID: 661eba1ea82d98063ec9171325e7be6dd56c8cebdfa07e83017ac80fe8b02245
                                                                                                                                                                                                          • Instruction ID: a64dc1d9d1b4e1941bf83ce4521108904637978546aa99a4301eec53fff47731
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 661eba1ea82d98063ec9171325e7be6dd56c8cebdfa07e83017ac80fe8b02245
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A251D733B5AA40DAFB495F32994C328B371ABABFD5F084258DE1906B25DF39C154C350
                                                                                                                                                                                                          Function 66F91BB0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • ../src/platforms/windows/hdinfo.c, xrefs: 66F91D07
                                                                                                                                                                                                          • %02x:%02x:%02x:%02x:%02x:%02x, xrefs: 66F91C49
                                                                                                                                                                                                          • Too small size, xrefs: 66F91D00
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Process$AdaptersAddressesAllocFree
                                                                                                                                                                                                          • String ID: %02x:%02x:%02x:%02x:%02x:%02x$../src/platforms/windows/hdinfo.c$Too small size
                                                                                                                                                                                                          • API String ID: 1283795797-3992030336
                                                                                                                                                                                                          • Opcode ID: b9ecc508961badcf67c57339c1eeb25e59cfe75f2fea1e6ca6f543c3f17c6b54
                                                                                                                                                                                                          • Instruction ID: a84e10c400ba51bba6dbee66a7cc4ab580e96fdb8d60e6c698fff64026ecd24c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b9ecc508961badcf67c57339c1eeb25e59cfe75f2fea1e6ca6f543c3f17c6b54
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D531C9227085508AF715DBBABC107AEBB96A7897D8F044336AD6C837D4EA3CC541D710
                                                                                                                                                                                                          Function 00007FF654CA8440 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                          • API String ID: 1339360106-2855260032
                                                                                                                                                                                                          • Opcode ID: fe406d8fb547cea20d7bfb8102cc3596c6133abc484eadb2eb76a5d76b1726db
                                                                                                                                                                                                          • Instruction ID: 6feeda8b429cc0ac5ab239d524766e68f7f5bd45a70907752286bcdf451545fb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe406d8fb547cea20d7bfb8102cc3596c6133abc484eadb2eb76a5d76b1726db
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD318FA160864242E7109B52B8A47AA7371AFC5BA4F584276EE6DA3BD4DF3CD405C700
                                                                                                                                                                                                          Function 66F81DF0 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 90stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strncmp$Err_Format_errno$freememcpystrlen
                                                                                                                                                                                                          • String ID: %s (%d:%d)$*DOMAIN:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*MID:$5(
                                                                                                                                                                                                          • API String ID: 3958490578-1731549688
                                                                                                                                                                                                          • Opcode ID: 3680ad2c6e9ce4542123035bb5878db8c477c5f00d64d280c243a012d2a8abc0
                                                                                                                                                                                                          • Instruction ID: a32d9cda8ba9c105160391164478276016c5f235be937ce4635c4661f56a7db5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3680ad2c6e9ce4542123035bb5878db8c477c5f00d64d280c243a012d2a8abc0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB21F12532865095FF50CB22EC48B5626A1BB4ABE9FC0555ACD2C4B7D0DF2FD245C331
                                                                                                                                                                                                          Function 00007FF654CAE270 Relevance: 25.7, APIs: 17, Instructions: 223COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1093732947-0
                                                                                                                                                                                                          • Opcode ID: 18a3bf99bbea6804c92c0b9e4b21d59020ad17d25526b3b34f8233c8396aa3f0
                                                                                                                                                                                                          • Instruction ID: 48c3d16ae4a0d8245a67ff6491d3204a8a2541cc9008ad528d788b2e1e2ea89d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 18a3bf99bbea6804c92c0b9e4b21d59020ad17d25526b3b34f8233c8396aa3f0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22A140A6F05B5588FB409BA6D8902BD33B0BB85B88F844576DE4CA7799EF3CD4018360
                                                                                                                                                                                                          Function 66F8F8F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Invalid type for op_build, xrefs: 66F8FB4C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: List_$DeallocDict_$ExtendTuple_Update
                                                                                                                                                                                                          • String ID: Invalid type for op_build
                                                                                                                                                                                                          • API String ID: 3794787204-1006902009
                                                                                                                                                                                                          • Opcode ID: 6a5439ea67cc0a07edc4bc5cae7ea3351b7d5feb805250f2303c0f84ff580a8b
                                                                                                                                                                                                          • Instruction ID: 018ec28ebe7e8c78debdb33660995fa2c75e44fa731002115d8be06d64a029af
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a5439ea67cc0a07edc4bc5cae7ea3351b7d5feb805250f2303c0f84ff580a8b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9051DF73B1BA059AFA888F69AC543692371ABC9FE8F5480A9CD1D43718EE2DC146C350
                                                                                                                                                                                                          Function 66F90D80 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Too many format strings, xrefs: 66F90DBD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$Err_FormatObject_StringUnicode_
                                                                                                                                                                                                          • String ID: Too many format strings
                                                                                                                                                                                                          • API String ID: 3094464462-2091874682
                                                                                                                                                                                                          • Opcode ID: adb419af5e2eedd341bd9b8ca218522e090d333e3a0d68c60dacbd5504573659
                                                                                                                                                                                                          • Instruction ID: 43c34416b8672bfe8095ba20bb8b5cadc19bb25acf242af9875e110f065ad4da
                                                                                                                                                                                                          • Opcode Fuzzy Hash: adb419af5e2eedd341bd9b8ca218522e090d333e3a0d68c60dacbd5504573659
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9351C433B19A44D2FF149F25A988329B362E784BCDF444629CE1D47B14EFB9C655C390
                                                                                                                                                                                                          Function 66F81A30 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 170COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DictDict_Err_Eval_FormatFrameFunction_ItemModule_SelfStringUnicode_
                                                                                                                                                                                                          • String ID: %s (%d:%d)$__dict__$__pyarmor__$protection exception (%d)
                                                                                                                                                                                                          • API String ID: 3372622024-629680938
                                                                                                                                                                                                          • Opcode ID: d9dbc4243d0aa4038ba619429e61402baed0799e43e4d4327ebb9ec8415299dc
                                                                                                                                                                                                          • Instruction ID: a71c04fc0aae93c3799fc96dca216ea9e0315738c9af84e45599746ad86d4864
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d9dbc4243d0aa4038ba619429e61402baed0799e43e4d4327ebb9ec8415299dc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A5519D72B09A4586FE05CB66D8487A83771EB89FD8F494269CE3D07361EE29C199C310
                                                                                                                                                                                                          Function 00007FF654CA4FB0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 138stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • strncmp.MSVCRT ref: 00007FF654CA506F
                                                                                                                                                                                                          • mbstowcs.MSVCRT(00000000,C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone,C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442,?,?,?,_MEIPASS2,00007FF654CA56C4), ref: 00007FF654CA509F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone, xrefs: 00007FF654CA4FBD
                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442, xrefs: 00007FF654CA4FBC
                                                                                                                                                                                                          • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00007FF654CA51B9
                                                                                                                                                                                                          • _MEIPASS2, xrefs: 00007FF654CA4FB0
                                                                                                                                                                                                          • pyi-, xrefs: 00007FF654CA503C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: mbstowcsstrncmp
                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone$C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442$Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$_MEIPASS2$pyi-
                                                                                                                                                                                                          • API String ID: 1807066385-2997176521
                                                                                                                                                                                                          • Opcode ID: 4cd6353d8287d9ebdc7f42e50edfcd29b2454bf44d82fac0beb1f5a7f2d26726
                                                                                                                                                                                                          • Instruction ID: 8896b3b46835a2ba052d1b17a90308db01e8038b6a0ce010468dfe7c4a314018
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4cd6353d8287d9ebdc7f42e50edfcd29b2454bf44d82fac0beb1f5a7f2d26726
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 855171A5A0860681FB149F27D8A43792371AFC5B80F8880B7CD1EA73E1DE3DE4419750
                                                                                                                                                                                                          Function 00007FF654CA79C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                          • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                          • API String ID: 1833775142-3524285272
                                                                                                                                                                                                          • Opcode ID: 8ef660b42063669becf1bd41f8a29df173ea005990595a1a776f16ce8dcaa147
                                                                                                                                                                                                          • Instruction ID: 987aecc7d3df137f483188ecc238f26ea64b04d5271b215a9f71ed6878d3b341
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ef660b42063669becf1bd41f8a29df173ea005990595a1a776f16ce8dcaa147
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2415072A0878285EB209B65F8A43EA7370FBC5794F484136DA8D97795DF7CD088CB40
                                                                                                                                                                                                          Function 66F91700 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 137COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Function_$ItemTuple_$BuildDeallocNameQualValueWith
                                                                                                                                                                                                          • String ID: (O)
                                                                                                                                                                                                          • API String ID: 239567734-4232840684
                                                                                                                                                                                                          • Opcode ID: caf2b0332e50d200b9cdd988d2f284a0eb3577fbac5d22b41583abf0419b7acc
                                                                                                                                                                                                          • Instruction ID: 7abde04ce337e40c57d33cc810fe7211bf1e6d753d84551ae0fe7dd8339f0bef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: caf2b0332e50d200b9cdd988d2f284a0eb3577fbac5d22b41583abf0419b7acc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 40419133A49A40C2FB1ACF26E84876A736AFB49BC4F448231DE6D06B55DF39C191D351
                                                                                                                                                                                                          Function 66F885F0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F886DF
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F88747
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Mem_Memory$BufferBuffer_CallDeallocFillFormatFromInfoMallocMethodNumber_Object_OccurredReallocSizeSsize_tView_
                                                                                                                                                                                                          • String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 3190434935-3742967138
                                                                                                                                                                                                          • Opcode ID: 6be31fb123a86346381b4fef954e3e12630b7a4ac16b367fb1982ec1dd5f3ed5
                                                                                                                                                                                                          • Instruction ID: 0b9d6975c4c3f00fe63cd4eeefa1fbed60f5443a653d76024f7c2f33c90b2104
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6be31fb123a86346381b4fef954e3e12630b7a4ac16b367fb1982ec1dd5f3ed5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E7418072729A04D6FB01DB65E8043582372B749FE9F8442298D3D477A4EF3DC59AC360
                                                                                                                                                                                                          Function 66F9DC90 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: callocfree
                                                                                                                                                                                                          • String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
                                                                                                                                                                                                          • API String ID: 306872129-190324370
                                                                                                                                                                                                          • Opcode ID: 15ba9e8f4dea9953f3ed2897a35c1b83790b875f13c39b799915dfb9f58af935
                                                                                                                                                                                                          • Instruction ID: fae5e1af9e5e0411e458929fb1ffda9a4499f2da679062149abb185e3896474a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 15ba9e8f4dea9953f3ed2897a35c1b83790b875f13c39b799915dfb9f58af935
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 69C1CF32B08AC0C6EB50DF62E84879AB765FB88BD9F415222DE8D97718EF79C444C750
                                                                                                                                                                                                          Function 66F9F730 Relevance: 21.3, APIs: 9, Strings: 5, Instructions: 254COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$memcmp$malloc
                                                                                                                                                                                                          • String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
                                                                                                                                                                                                          • API String ID: 2896619906-237625700
                                                                                                                                                                                                          • Opcode ID: 256103562b279499cccbc6ff03a37f4163cfeaf89722f50143bfc127f4f2139c
                                                                                                                                                                                                          • Instruction ID: 1cb6d1df11fcd6ec2ae403ee78684078e8e0057743cb67e00ae7bf8c30116e56
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 256103562b279499cccbc6ff03a37f4163cfeaf89722f50143bfc127f4f2139c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8EB1AD726096C1CAF7A0CF12E94479ABBA0F3C8798F004216EE8997B58DB7DC449CB51
                                                                                                                                                                                                          Function 00007FF654CA31B0 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 202stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA3140: strcpy.MSVCRT(?,?,_MEIPASS2,?,00007FF654CA362C), ref: 00007FF654CA3183
                                                                                                                                                                                                          • strcmp.MSVCRT ref: 00007FF654CA333C
                                                                                                                                                                                                          • strcmp.MSVCRT ref: 00007FF654CA335F
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fread.MSVCRT ref: 00007FF654CA78B1
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: ferror.MSVCRT ref: 00007FF654CA78C1
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: clearerr.MSVCRT(?,00000000,?,00007FF654CA3267,?,00000000,?,00000000,?,?,_MEIPASS2,?,00007FF654CA362C), ref: 00007FF654CA78CD
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fclose.MSVCRT ref: 00007FF654CA7909
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA7840: fclose.MSVCRT ref: 00007FF654CA7911
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclosestrcmp$clearerrferrorfreadstrcpy
                                                                                                                                                                                                          • String ID: %s%s%s$%s%s%s%s%s$%s%s%s%s%s%s%s$%s%s%s.exe$%s%s%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Error copying %s$Error extracting %s$Error opening archive %s$_MEIPASS2$malloc
                                                                                                                                                                                                          • API String ID: 2929065527-1083822304
                                                                                                                                                                                                          • Opcode ID: 9436801669d51a629e3fcac19a4da0c11387a79bf2d9244b869e701ab383b238
                                                                                                                                                                                                          • Instruction ID: c4b7c286565264d354afc042142f1fca079c9f0df6d692b30c39b3c4c317a512
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9436801669d51a629e3fcac19a4da0c11387a79bf2d9244b869e701ab383b238
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 058143A1A08A4251FA109B66E8B41FA6674AFC47D4F4841B3EE4DE7BE6DE3CE545C300
                                                                                                                                                                                                          Function 00007FF654CA7110 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF654CA714B
                                                                                                                                                                                                          • free.MSVCRT ref: 00007FF654CA7156
                                                                                                                                                                                                          • _wfullpath.MSVCRT ref: 00007FF654CA717E
                                                                                                                                                                                                          • wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71AD
                                                                                                                                                                                                          • wcsncpy.MSVCRT ref: 00007FF654CA71DB
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71E5
                                                                                                                                                                                                          • wcschr.MSVCRT(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA71F0
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,?,00000000,00007FF654CA72AB,?,?,?,00000000,?,00000012,00000000,00000000,00007FF654CA746B), ref: 00007FF654CA7202
                                                                                                                                                                                                          • _wcsdup.MSVCRT ref: 00007FF654CA721B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF654CA7250
                                                                                                                                                                                                          • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF654CA7230
                                                                                                                                                                                                          • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF654CA7260
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                                                                                                                                                                                          • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                          • API String ID: 274989731-3498232454
                                                                                                                                                                                                          • Opcode ID: d414b3e691f8c4d26ce76b45fbcb3174c9ed9ce5588de55e0f29948b1c7c796a
                                                                                                                                                                                                          • Instruction ID: 74490da21c68abeb4f98825352fe761e65e5eb0397b104ffbe40d1d688640675
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d414b3e691f8c4d26ce76b45fbcb3174c9ed9ce5588de55e0f29948b1c7c796a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B531F791B4D64285FA65A76698B43FA11A26FC8BC1FCC4476DE0EFB7C5ED2CE0458310
                                                                                                                                                                                                          Function 66F90B7E Relevance: 21.1, APIs: 14, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Restore$DeallocExceptionException_FetchNormalize$Back_ContextEval_FrameHereOccurredTraceTraceback
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4214459649-0
                                                                                                                                                                                                          • Opcode ID: 8e921b868482a4647cf288f8b5169c51234217630db6041e9c0b008727c7077d
                                                                                                                                                                                                          • Instruction ID: c42bd45544004a0d88d93d823ccd79dde6b6163585614337aca3c002cc19e9ec
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e921b868482a4647cf288f8b5169c51234217630db6041e9c0b008727c7077d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48414477208BC0D5EA25DB56F80839AB322FB8ABD4F54801ADE9D43B28CF39C145CB51
                                                                                                                                                                                                          Function 66F91D40 Relevance: 19.6, APIs: 13, Instructions: 96memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Process$AdaptersAddressesAllocFree$inet_ntoa
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4108032510-0
                                                                                                                                                                                                          • Opcode ID: 9f0ede1b55dc2dd9832a026050341d10ef431b5a01c9a94c5069eab152c385c4
                                                                                                                                                                                                          • Instruction ID: 90b0384b59742507a37e99905f458bcecdd804941c3dc0b7323dc8af50c3d7d4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f0ede1b55dc2dd9832a026050341d10ef431b5a01c9a94c5069eab152c385c4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3621EA2271964046FB04EB77BC1075AB696AB89FD8F088336ED2C477E4EE39D442C750
                                                                                                                                                                                                          Function 00007FF654CA5410 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$setlocale$_strdupcalloc
                                                                                                                                                                                                          • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                                                                                                                                                                                          • API String ID: 3058678114-3355598041
                                                                                                                                                                                                          • Opcode ID: b3a94ae4ac6b4f6312338ae72a3d926f4a238985db292fd2604171276d9b9414
                                                                                                                                                                                                          • Instruction ID: b37cbe9adbc706a66e8b13a9d33bc4c771da5d6c849319b5a869130fa528bd46
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3a94ae4ac6b4f6312338ae72a3d926f4a238985db292fd2604171276d9b9414
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F21C192B0961251FA15E716D8B13BD6661AFC4B84FCCC4B6DD4EAB782EE3CE8458310
                                                                                                                                                                                                          Function 00007FF654CA29E0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$_wcsdup$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                          • API String ID: 2803985813-2699770090
                                                                                                                                                                                                          • Opcode ID: f526219bed773062a0d0eb333ccd5c88dea8aa0be73e6a7d34a87cd471690584
                                                                                                                                                                                                          • Instruction ID: f65e00833b24fff55ad8e33450edaa6d9902ffb8a622caae0893211575ac7eb8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f526219bed773062a0d0eb333ccd5c88dea8aa0be73e6a7d34a87cd471690584
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48218171A09A8281EA25DB52F8A46FA7370BFC5B80F884076EE4EA3B45DE3CD0458710
                                                                                                                                                                                                          Function 66F88FA0 Relevance: 18.3, APIs: 12, Instructions: 252fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwrite
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3559309478-0
                                                                                                                                                                                                          • Opcode ID: 714a94cc15264e56acb3af836d6436b7d2c318e9dc132846ab81ddfae765e9b2
                                                                                                                                                                                                          • Instruction ID: a8fa46b59dfc88532f4231ab1f7e160090fbf278d630022c8c1a9359dc7c1218
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 714a94cc15264e56acb3af836d6436b7d2c318e9dc132846ab81ddfae765e9b2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5A1AFB2204B4082DB14CFA9E15439977B6F759FE8F50522ACE6E5B398DF38C594C380
                                                                                                                                                                                                          Function 00007FF654CA5EE0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlenstrncpy$callocfreememcpy
                                                                                                                                                                                                          • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
                                                                                                                                                                                                          • API String ID: 4189425833-927121926
                                                                                                                                                                                                          • Opcode ID: 0278ade198d4d4fb4f4b46b933373953a4129a425002dc51c7dac0e2962247a5
                                                                                                                                                                                                          • Instruction ID: 3838584349d1490d4bcda8e338be0a0421b1023dce89942d3d894a3b134a78bb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0278ade198d4d4fb4f4b46b933373953a4129a425002dc51c7dac0e2962247a5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FD41F69170865255EA14EA23D8A47FA6374BFC4BC4F8C81B2EE1DA7786DE3CE145C314
                                                                                                                                                                                                          Function 66F919C0 Relevance: 18.1, APIs: 12, Instructions: 111memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Process$Free$Alloc$AdaptersAddressesmemcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1739390247-0
                                                                                                                                                                                                          • Opcode ID: 8b7173cbf525848e8b2f0710f6e2e3af896d06d9160effeb2f956b6adda84d23
                                                                                                                                                                                                          • Instruction ID: b0b9927c07ace571f078fcd1ffdbb95e1fda3534197f14f11e2e96082ff7875a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8b7173cbf525848e8b2f0710f6e2e3af896d06d9160effeb2f956b6adda84d23
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4331F8337156818AFB44DB76AC04B9D73A69B89BD8F488235EE1C87754EF38C989C700
                                                                                                                                                                                                          Function 66FFFB50 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,66F81278), ref: 66FFFC7D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Unknown pseudo relocation bit size %d., xrefs: 66FFFDEA
                                                                                                                                                                                                          • Unknown pseudo relocation protocol version %d., xrefs: 66FFFDFE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                                                                                                                                                          • API String ID: 544645111-395989641
                                                                                                                                                                                                          • Opcode ID: f6de90c3a48d35dd0d7869126c3aa8fe806ab83cd1bc7bc40e79d601065f5849
                                                                                                                                                                                                          • Instruction ID: 39fbf0baec1b8abd043aa2b36262368f6d4932739c842dbc001fe2b9be0774d3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f6de90c3a48d35dd0d7869126c3aa8fe806ab83cd1bc7bc40e79d601065f5849
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 79912232B366428BFB948B65D89070D6762A7CA7A8F508516CF2C977F8DA3DC183C711
                                                                                                                                                                                                          Function 66F93980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: freemallocmemcpystrchrstrlen
                                                                                                                                                                                                          • String ID: and,$http://$local$or,
                                                                                                                                                                                                          • API String ID: 3771145599-2506292620
                                                                                                                                                                                                          • Opcode ID: fffd6cc5c076cb560c0c2160982a51acd8c4d7517aa773c66e178a1a6288fccf
                                                                                                                                                                                                          • Instruction ID: b09a291707bef11e2d6e0858693b72db96e8daf93168a0d5c87ee60488b2fc67
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fffd6cc5c076cb560c0c2160982a51acd8c4d7517aa773c66e178a1a6288fccf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E31272770968896FE50CE23990036A2B51E746BF8F844B258E3C177D4EF3AC84AC321
                                                                                                                                                                                                          Function 00007FF654CA2350 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                          • Opcode ID: fea85488d9d1cac119e4a29d1ca9f633e5fae16107e641c76dad77d3c19cf46f
                                                                                                                                                                                                          • Instruction ID: 5a3431e8b08e52a4e24999c880935af3c735b4784b6e8aa00516d9c09925fbb2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fea85488d9d1cac119e4a29d1ca9f633e5fae16107e641c76dad77d3c19cf46f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F44187762156A18AD7208F36E44877977B1F788F99F084232EE8987B58DF3CD185CB20
                                                                                                                                                                                                          Function 66F89C00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (list size out of range), xrefs: 66F8A95C
                                                                                                                                                                                                          • NULL object in marshal data for list, xrefs: 66F8AFF3
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_List_Occurred
                                                                                                                                                                                                          • String ID: NULL object in marshal data for list$bad marshal data (list size out of range)
                                                                                                                                                                                                          • API String ID: 1902535023-3453879413
                                                                                                                                                                                                          • Opcode ID: 7068d00fd5fc174c97d1d790006e4ee2cda09aa94e9709285f5ba7c3c173cf4a
                                                                                                                                                                                                          • Instruction ID: 7ec92c6c5a780edb53887041a04ceb5106b585184bcbc56c6e49694fedc5ec98
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7068d00fd5fc174c97d1d790006e4ee2cda09aa94e9709285f5ba7c3c173cf4a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 38316732709A80C7FE04CF19E88835A63B2FB85B95F118499CD2E0B3A4EF3AC555C390
                                                                                                                                                                                                          Function 66F89E54 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (tuple size out of range), xrefs: 66F8AC3A
                                                                                                                                                                                                          • NULL object in marshal data for tuple, xrefs: 66F8AE3C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_OccurredTuple_
                                                                                                                                                                                                          • String ID: NULL object in marshal data for tuple$bad marshal data (tuple size out of range)
                                                                                                                                                                                                          • API String ID: 3674511531-3094253248
                                                                                                                                                                                                          • Opcode ID: 33dc34a28eb63f0420196389db7f1adaa6b5a59f8a0d32986827911ff0d1f688
                                                                                                                                                                                                          • Instruction ID: e9fe73f7e62c5c5c0d802c83627c9ff2b6b4e7e1127fc9b216f076fa855621a5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 33dc34a28eb63f0420196389db7f1adaa6b5a59f8a0d32986827911ff0d1f688
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9B217C32709A40C7FE14CF29D58C71A23B6FB89B94F518498CD1E173A8DE3AD145C390
                                                                                                                                                                                                          Function 66F98380 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 356stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen
                                                                                                                                                                                                          • String ID: 8$?$?$@$MD5$in != NULL$md != NULL$src/hashes/md5.c
                                                                                                                                                                                                          • API String ID: 39653677-3461814546
                                                                                                                                                                                                          • Opcode ID: 59980e96bab5f09518a5dcd9d66e48bf7f3f68a7c3a5db963c42a737ce733e52
                                                                                                                                                                                                          • Instruction ID: 09f8f9e19cd2ac6bba381aea28b70d756a71339cb0c4fa554243a5a8fc9b1db9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 59980e96bab5f09518a5dcd9d66e48bf7f3f68a7c3a5db963c42a737ce733e52
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7DD1FEB3A18281ABF715CB1AE454B2EBFA0E791388F504A09CFA20BB45D77DD445CB52
                                                                                                                                                                                                          Function 00007FF654CA5CC0 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 124stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcpy$mallocstrncpy$callocfreestrlenstrncat
                                                                                                                                                                                                          • String ID: Cannot allocate memory for necessary files.$_MEIPASS2
                                                                                                                                                                                                          • API String ID: 257583877-1389504347
                                                                                                                                                                                                          • Opcode ID: dcdcf1ad8441f74bd5f484d301417646872c8ea22c2ab649397ffc669518642c
                                                                                                                                                                                                          • Instruction ID: 8d1787d98f764d605fcd2b9c2f1131e514017fab3f9d5bc73a880ffff7624449
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dcdcf1ad8441f74bd5f484d301417646872c8ea22c2ab649397ffc669518642c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0241E3B2B0524146EA28DA22D5A42ED7772BF847D0F888472CF1EA37C5EE7CE5458310
                                                                                                                                                                                                          Function 66F9D230 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 99stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strcmp
                                                                                                                                                                                                          • String ID: aes$name != NULL$src/misc/crypt/crypt_find_hash.c
                                                                                                                                                                                                          • API String ID: 1004003707-455514378
                                                                                                                                                                                                          • Opcode ID: 9f9ec8a7de5766cfade81fec29086a0005c32b77326fbf79db292890a566154b
                                                                                                                                                                                                          • Instruction ID: 7b29fdb6e09e31ce8b372b50d64107c8a8d03313bf39faaab4acda562b5daa4b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f9ec8a7de5766cfade81fec29086a0005c32b77326fbf79db292890a566154b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB31983170AA8A4AFF59CE62DAD4BBD6311EF45BD8F504211CF6D8B944EF28D109C321
                                                                                                                                                                                                          Function 66F89EE0 Relevance: 16.6, APIs: 11, Instructions: 85COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_$AppendDeallocItemList_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2970173465-0
                                                                                                                                                                                                          • Opcode ID: 13ef8c274b68a0f393cfd0dd411798b1bcd771080739aa67edb9211dcdedb3ce
                                                                                                                                                                                                          • Instruction ID: 5868c44794bcfbfb9ab949d820784cb6b4525efb69f7c8284c2ee066e9820a75
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 13ef8c274b68a0f393cfd0dd411798b1bcd771080739aa67edb9211dcdedb3ce
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB316A32B0AA8087FE548F26E95835963F4FB8AB95F4884A8CE5E46754EF3E8141C310
                                                                                                                                                                                                          Function 66F92140 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Heap$Process$Free$Alloc$NetworkParams
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3483679945-0
                                                                                                                                                                                                          • Opcode ID: 7ad505b3a7de0c2a1a590e8c2f802425ba64086e80456d639e239c01a286d689
                                                                                                                                                                                                          • Instruction ID: d6274f1036476717d52b77c2640097b9c33660b2e21e4dc9b2364c50d841b838
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7ad505b3a7de0c2a1a590e8c2f802425ba64086e80456d639e239c01a286d689
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D811081272554585FA14DBB77C00BAAEB526BCEBD8F0882379D2C973E5EE39C1438310
                                                                                                                                                                                                          Function 66F84D5B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 144COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 66F8E850: PyList_New.PYTHON38 ref: 66F8E88A
                                                                                                                                                                                                            • Part of subcall function 66F8E850: PyMem_Free.PYTHON38 ref: 66F8E8C3
                                                                                                                                                                                                          • _PyDict_GetItemIdWithError.PYTHON38 ref: 66F8F33A
                                                                                                                                                                                                          • _Py_CheckFunctionResult.PYTHON38 ref: 66F8F3D7
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F8F405
                                                                                                                                                                                                          • _PyObject_MakeTpCall.PYTHON38 ref: 66F8F440
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F8F452
                                                                                                                                                                                                          • _PyLong_AsInt.PYTHON38 ref: 66F8F483
                                                                                                                                                                                                          • PyImport_ImportModuleLevelObject.PYTHON38 ref: 66F8F4B0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dealloc$CallCheckDict_ErrorFreeFunctionImportImport_ItemLevelList_Long_MakeMem_ModuleObjectObject_ResultWith
                                                                                                                                                                                                          • String ID: __import__ not found
                                                                                                                                                                                                          • API String ID: 3239429168-2199325508
                                                                                                                                                                                                          • Opcode ID: 69df2478730bbf397de619e03f0d570ce7e2c45be5edd48ed93e082266fdfa7e
                                                                                                                                                                                                          • Instruction ID: 91d7a7a15087c638c66b09f00dd62928d07150e9e6f800b720a2d04ffab96a6f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 69df2478730bbf397de619e03f0d570ce7e2c45be5edd48ed93e082266fdfa7e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 15519F33716B448AEA858F2AEA44359A371F7C9FE9F44006ADE1E47B64DF39C195C310
                                                                                                                                                                                                          Function 66F81660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FormatOccurred
                                                                                                                                                                                                          • String ID: %s (%d:%d)
                                                                                                                                                                                                          • API String ID: 4038069558-1595188566
                                                                                                                                                                                                          • Opcode ID: 4bd8c9fc301770ba8758a391c4fdd217cc08a388c3e49bcf0effea84071363ef
                                                                                                                                                                                                          • Instruction ID: f5b70300ba9996b3f99f9a1508344f9170ededf7e84b8049ab08667f9ebb5505
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bd8c9fc301770ba8758a391c4fdd217cc08a388c3e49bcf0effea84071363ef
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9D411333B1878182EB04CB59E85536E7771F78ABD8F89426DCEAE07B25CE29C141C750
                                                                                                                                                                                                          Function 670000A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: signal
                                                                                                                                                                                                          • String ID: CCG
                                                                                                                                                                                                          • API String ID: 1946981877-1584390748
                                                                                                                                                                                                          • Opcode ID: 12f7bdf2ff622a9129fd616f39148eef126af7f08d92e0a44bc2d5e83231ebf8
                                                                                                                                                                                                          • Instruction ID: bbe9cd2f269efccffdf89385beac01b13edaa3c546fcedc12f2cbdf61d362118
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12f7bdf2ff622a9129fd616f39148eef126af7f08d92e0a44bc2d5e83231ebf8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2031823077D4058AFB194EB988607A910929B9E338F548A26CB7DC73E1FE69D5C54333
                                                                                                                                                                                                          Function 66F898E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F898F0
                                                                                                                                                                                                          • PyUnicode_DecodeUTF8.PYTHON38 ref: 66F8A0BF
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (string size out of range), xrefs: 66F8A88A
                                                                                                                                                                                                          • surrogatepass, xrefs: 66F8A0B5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DecodeErr_OccurredUnicode_
                                                                                                                                                                                                          • String ID: bad marshal data (string size out of range)$surrogatepass
                                                                                                                                                                                                          • API String ID: 1138423624-4021928140
                                                                                                                                                                                                          • Opcode ID: ffc3fdf5d164e5c4e6a4ef55206fc67a0b21d8f961f11ecb69c699365fa9f1a6
                                                                                                                                                                                                          • Instruction ID: 448ddac48928a901f7530d49ecea8ebcd6e36cb97a0705a530efd1b943777d10
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ffc3fdf5d164e5c4e6a4ef55206fc67a0b21d8f961f11ecb69c699365fa9f1a6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D31AE33709A9087F611CF19D48875A73B6FB88BA0F01C598CE5A17758DF3AD686C380
                                                                                                                                                                                                          Function 66F87FB0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$FetchFormatFromObject_RestoreWindowsstrerror
                                                                                                                                                                                                          • String ID: %s (%d:%d)
                                                                                                                                                                                                          • API String ID: 2858978339-1595188566
                                                                                                                                                                                                          • Opcode ID: fcc91ca7e521a33297c532549300778566aefd768eb892d5943477e1cc5354f1
                                                                                                                                                                                                          • Instruction ID: 90155649b92196330e38c7cdf82bbd728b7e8881c9d1326faddd6ccba49cb780
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fcc91ca7e521a33297c532549300778566aefd768eb892d5943477e1cc5354f1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C421D333A19A44C2FB01CB19E8543997771EB8AB98F95502ACE6E13361CE3EC545C390
                                                                                                                                                                                                          Function 00007FF654CA7E50 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                          • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                          • API String ID: 1653872744-2573406579
                                                                                                                                                                                                          • Opcode ID: cbdb8eea67fde94177a7de486669295192c3b68fd3ad581342b718ce3b64fd12
                                                                                                                                                                                                          • Instruction ID: 17ace3ffe9bc72564030de6aadc604497a6a47deef951c714ff299baa734e2c8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbdb8eea67fde94177a7de486669295192c3b68fd3ad581342b718ce3b64fd12
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5021AEB1A18A4381F7609B15F8E07A62271AFC5394F8C41BAE94DA2AA4DF3CD589C700
                                                                                                                                                                                                          Function 66F8E510 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F8E598
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F8E5B7
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
                                                                                                                                                                                                          • String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 28673812-3742967138
                                                                                                                                                                                                          • Opcode ID: fc56d96de3c5d5125a3c1009fc05114574b7dba2801ec61b2e0e290047db93e5
                                                                                                                                                                                                          • Instruction ID: b18fa9fecf76308c7c109f7eeb945d1971a29c86d3f3c7107f7dd89daf3f9354
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc56d96de3c5d5125a3c1009fc05114574b7dba2801ec61b2e0e290047db93e5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F111E53272C684C2FA108BAEEC483151372A749BE9F540225CD6D8B3A2EF2DC655C320
                                                                                                                                                                                                          Function 66F8E5E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 66F8E65B
                                                                                                                                                                                                          • EOF read where not expected, xrefs: 66F8E677
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
                                                                                                                                                                                                          • String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                          • API String ID: 28673812-3742967138
                                                                                                                                                                                                          • Opcode ID: a64d3ec6dffc6bc87783c48ba7dbf8fed9385366a788c72028b083562a66a690
                                                                                                                                                                                                          • Instruction ID: c82fa6136501d7c42354f2f5cab0d18c66f9636ea6201b2b57b825b9ea1d7be1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a64d3ec6dffc6bc87783c48ba7dbf8fed9385366a788c72028b083562a66a690
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62118032B29544C2FE049B9AEC587551332A74AFF8F550269CE2D073F0DE3E9A55C360
                                                                                                                                                                                                          Function 66F9EED0 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 455COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: callocfree
                                                                                                                                                                                                          • String ID: in != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
                                                                                                                                                                                                          • API String ID: 306872129-2031961738
                                                                                                                                                                                                          • Opcode ID: 3d80d0657239a8b1e0c08d4430391272175d215dc6dc5e04f746c81100b7715a
                                                                                                                                                                                                          • Instruction ID: ec58151dfc91b7aa8c8d78e148e07bfb74d6b09c5e53d5738f592a2ddb05e935
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d80d0657239a8b1e0c08d4430391272175d215dc6dc5e04f746c81100b7715a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D122A72618B80C6E7A0CF26E84479AB7A4F785BDCF105216EF8987B58DF79C485CB40
                                                                                                                                                                                                          Function 00007FFDFB23BD30 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 238stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strncmp
                                                                                                                                                                                                          • String ID: %-8d$, path=$, retcode=$, value=$..\s\crypto\conf\conf_mod.c$OPENSSL_finish$OPENSSL_init$module=$path
                                                                                                                                                                                                          • API String ID: 1114863663-3652895664
                                                                                                                                                                                                          • Opcode ID: 7fa605a8ceb3b8543fbe42aa065cf00a204794484b58e037f1995578e6de5600
                                                                                                                                                                                                          • Instruction ID: 85cf23a8d8a4ecc7a644a4059001b0ad38249f6b1c2924fc6673a9255759d506
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7fa605a8ceb3b8543fbe42aa065cf00a204794484b58e037f1995578e6de5600
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9EA18022B0AB8781FB10AF55A864AB92290BF45B94F484135DD6D4BBFDEF3CE5858700
                                                                                                                                                                                                          Function 66F9D6B0 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 177COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • src/misc/crypt/crypt_register_hash.c, xrefs: 66F9D917
                                                                                                                                                                                                          • hash != NULL, xrefs: 66F9D91E
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcmp
                                                                                                                                                                                                          • String ID: hash != NULL$src/misc/crypt/crypt_register_hash.c
                                                                                                                                                                                                          • API String ID: 1475443563-1465673959
                                                                                                                                                                                                          • Opcode ID: 9a90915ac5f4da8954f2ad70a48be5c947d567dac467927d737f303674bc135e
                                                                                                                                                                                                          • Instruction ID: afb447b03221eefe439e58e1c30396767b66d353a57912a9853f1c6e1a4db918
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a90915ac5f4da8954f2ad70a48be5c947d567dac467927d737f303674bc135e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF617936710B4497F718CB26E984B9A7368F308B98F608126CF9987750EF39E55AC361
                                                                                                                                                                                                          Function 66F9D940 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • prng != NULL, xrefs: 66F9DB76
                                                                                                                                                                                                          • src/misc/crypt/crypt_register_prng.c, xrefs: 66F9DB6F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcmp
                                                                                                                                                                                                          • String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
                                                                                                                                                                                                          • API String ID: 1475443563-58737364
                                                                                                                                                                                                          • Opcode ID: c6a8de877113159093499213b2593711bf42504d00cabf3efa59fe949496abca
                                                                                                                                                                                                          • Instruction ID: 55daeb96d8f846e8affc7ca32b28baeabe346f96c69836d81dd41c10b211b38b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6a8de877113159093499213b2593711bf42504d00cabf3efa59fe949496abca
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A51C032750B8497FB20CF12D888B9A7768F748BD4F558226CF2983740EB78E15AC761
                                                                                                                                                                                                          Function 66F9D380 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 108stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strcmp
                                                                                                                                                                                                          • String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
                                                                                                                                                                                                          • API String ID: 1004003707-2030105502
                                                                                                                                                                                                          • Opcode ID: 4bf116380656867f60f687a57c1ea56dcad2253d0b0618ff4441cd8545de75a5
                                                                                                                                                                                                          • Instruction ID: c63226697e81839960dc316d9eb0e5b1ece4af981e754f4ad30f04b889bf4b64
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bf116380656867f60f687a57c1ea56dcad2253d0b0618ff4441cd8545de75a5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF31C421706A464AFF28CF679AD47BD6311FF46BDCF504221DF2A8B944EB18E10AC721
                                                                                                                                                                                                          Function 66F9D0E0 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 99stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • name != NULL, xrefs: 66F9D218
                                                                                                                                                                                                          • src/misc/crypt/crypt_find_cipher.c, xrefs: 66F9D211
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strcmp
                                                                                                                                                                                                          • String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
                                                                                                                                                                                                          • API String ID: 1004003707-679692990
                                                                                                                                                                                                          • Opcode ID: 98fa63aa5d99f17d4e734f52645fbab0fc417d6f86a0a1cb9aed78f4e7356562
                                                                                                                                                                                                          • Instruction ID: c4f0bdbeb95d9e733d773e43a850bd2e7fb575324c72e254ef09f2126d62f7a2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98fa63aa5d99f17d4e734f52645fbab0fc417d6f86a0a1cb9aed78f4e7356562
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C31CA6270698B4AFF28CE52CED47B96311EF46BD8F508211CF298B944EF24D14AC721
                                                                                                                                                                                                          Function 00007FF654CA7840 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fclose$strlen$clearerrferror$_wfopenfreadfwritestrcpystrtok
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4076046571-0
                                                                                                                                                                                                          • Opcode ID: 0ca4ef915f0a775d2389a04320ec273b6ce6437d5a5171d2091505cce8856d3f
                                                                                                                                                                                                          • Instruction ID: fdf851524041cf60aa971b2870663fcfe0cc434886bc99e8c92c91708060d421
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ca4ef915f0a775d2389a04320ec273b6ce6437d5a5171d2091505cce8856d3f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE214C91F0E25301F815A6639AB13B952A61FC6BE4F4C01B3ED0EFB7C6EE1CE8014691
                                                                                                                                                                                                          Function 00007FF654CB207B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
                                                                                                                                                                                                          • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                          • API String ID: 1485978544-2115465065
                                                                                                                                                                                                          • Opcode ID: c93050da29d2b53cde75ff4ecec3a5117cbc28d906d175e1e5974c7ea21a5eeb
                                                                                                                                                                                                          • Instruction ID: cff94670349e4770835808b7bccbc8572527a6fc23849749fdb466b07f7ad649
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c93050da29d2b53cde75ff4ecec3a5117cbc28d906d175e1e5974c7ea21a5eeb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9810BB6A04B458AEB14CF6AC8942AC37F0F788B9CB458566EE5D97B58DF38D440CB40
                                                                                                                                                                                                          Function 66F813C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 167COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ObjectSizeSys_Unicode_getenv
                                                                                                                                                                                                          • String ID: LANG$PYARMOR_LANG$_PARLANG
                                                                                                                                                                                                          • API String ID: 223123148-1822377752
                                                                                                                                                                                                          • Opcode ID: ede8a0e8718e638b0a6be7f9cf91a3111d91eaccac3b5b90de33bd3baee64b1e
                                                                                                                                                                                                          • Instruction ID: fb53a0cc38223e12ebc18f7713e6a0148a524c19e3b9c49a3df797d3235a5add
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ede8a0e8718e638b0a6be7f9cf91a3111d91eaccac3b5b90de33bd3baee64b1e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E551F6A2A0C29187FB01CB19D5803A93BB3B786B9DF49C29ACA7D47356D729C495C360
                                                                                                                                                                                                          Function 00007FF654CA8040 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                          • API String ID: 1374691127-27947307
                                                                                                                                                                                                          • Opcode ID: ea88749d0a14f64099691da4aeb15603b84fc63f6c062682654e53545a88106d
                                                                                                                                                                                                          • Instruction ID: 580e308a626259bb97198b4daae4dde7f46a5b023a7520462a3ef9cc856cef53
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea88749d0a14f64099691da4aeb15603b84fc63f6c062682654e53545a88106d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D021A1A1A18B4285FA14DB66E8F037662B0AFC4394F8C8177DA4EAAAD1DF7CD044C310
                                                                                                                                                                                                          Function 00007FF654CA7F50 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                          • API String ID: 1374691127-3831141058
                                                                                                                                                                                                          • Opcode ID: c974b491895e7bda57dd440c625f49c5a3727ada228be6d7fc02953d331cde25
                                                                                                                                                                                                          • Instruction ID: 4465dabc60b6ba3ba377ccd988cd8adaf7ff57e94bdfe8c70497c4725ac4c57d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c974b491895e7bda57dd440c625f49c5a3727ada228be6d7fc02953d331cde25
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D21D1A1A1C74245E7509B56E8F036666B1EFC4394F88417BE94EB66D5DF7CD104C300
                                                                                                                                                                                                          Function 00007FF654CA7B70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                          • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                          • API String ID: 4278403329-2782260415
                                                                                                                                                                                                          • Opcode ID: 945d6d8d56f37cfe0361321e39814a85846aa9c2cc1a836560a03a797768b115
                                                                                                                                                                                                          • Instruction ID: 47778568f69772fe3bc2d4f5ee564081688bd911694d37ab6ce697b9a629c490
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 945d6d8d56f37cfe0361321e39814a85846aa9c2cc1a836560a03a797768b115
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F111DFE1A1A64285F7119B52E8F01B97671BFC4740F9C41BACD0DA33A1EE3CE484C300
                                                                                                                                                                                                          Function 66FA75A0 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: malloc
                                                                                                                                                                                                          • String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
                                                                                                                                                                                                          • API String ID: 2803490479-2931318352
                                                                                                                                                                                                          • Opcode ID: 5802c16ceb22e0697a4cc36ec6c5506e4db02ae271dec38180cd6864647f904c
                                                                                                                                                                                                          • Instruction ID: 83205c2e0985c773e91e5655228572ac53ca5d95c8f462ba2bf58d90009b40dc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5802c16ceb22e0697a4cc36ec6c5506e4db02ae271dec38180cd6864647f904c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A51F27AB183908BEB11CF359904F7EBB65EB467C8F048014CE5647B08EB39E516CB20
                                                                                                                                                                                                          Function 00007FF654CA8210 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                          • String ID: %s%s: %s$Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                          • API String ID: 1374691127-2292745976
                                                                                                                                                                                                          • Opcode ID: e25d75c4397cd3946ce71200e75b93b7a887f4a347cf1552ce9ec0bda547e504
                                                                                                                                                                                                          • Instruction ID: 1a86a265c6b070f7596c4c3ecf98d12c87cc4de1c4d3bd552fcbcb96baa33454
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e25d75c4397cd3946ce71200e75b93b7a887f4a347cf1552ce9ec0bda547e504
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B1193E1F09A4245FA24DB66E8B02B522B19FC8798F8C4277D94DA76D1EE3CE045C320
                                                                                                                                                                                                          Function 66F89950 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyUnicode_FromKindAndData.PYTHON38 ref: 66F89999
                                                                                                                                                                                                          • PyErr_SetString.PYTHON38 ref: 66F8A2F9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • EOF read where object expected, xrefs: 66F8A2EC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DataErr_FromKindStringUnicode_
                                                                                                                                                                                                          • String ID: EOF read where object expected
                                                                                                                                                                                                          • API String ID: 3898585613-3634523442
                                                                                                                                                                                                          • Opcode ID: 12b60aab1b1ecbd908c0c9e25cf520ede2315fe8f49d1c43c69bcb33044c900e
                                                                                                                                                                                                          • Instruction ID: b92663c606a92cdd0727bd886f188317bbc05f3c9639ee2cc4a4cc658c0c59cd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12b60aab1b1ecbd908c0c9e25cf520ede2315fe8f49d1c43c69bcb33044c900e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1631AE333096808AFA11CF19D48875A37B5FB88BD4F418598CE5E17398DF3AD586C790
                                                                                                                                                                                                          Function 66F88C60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • EOF read where object expected, xrefs: 66F88D19
                                                                                                                                                                                                          • marshal data too short, xrefs: 66F88D6C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_S_string_to_doubleStringmemcpy
                                                                                                                                                                                                          • String ID: EOF read where object expected$marshal data too short
                                                                                                                                                                                                          • API String ID: 1651926552-3827827332
                                                                                                                                                                                                          • Opcode ID: 6686ed67ce2cd4d8a9d388cb7dfffe3d1e60d80091aae381cae9746d654e5bd5
                                                                                                                                                                                                          • Instruction ID: d6306265677b518e8035a6125656d6cea411ab89020ee939eaf37ed947832088
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6686ed67ce2cd4d8a9d388cb7dfffe3d1e60d80091aae381cae9746d654e5bd5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B831AE7271AA04D5FF15DF29E8003682372BB59BD8F544266CE2D07768DF2CC5A6C390
                                                                                                                                                                                                          Function 66F83790 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F837ED
                                                                                                                                                                                                          • _PyObject_CallMethod_SizeT.PYTHON38 ref: 66F837FF
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F8380B
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F83883
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CallDeallocMethod_Object_Size
                                                                                                                                                                                                          • String ID: %U.%s$close$read
                                                                                                                                                                                                          • API String ID: 3129687173-1885073756
                                                                                                                                                                                                          • Opcode ID: 606ed7b1692c76c641d5613d1b6d66393b10fb6f7be18d701976a0a0b2ea412d
                                                                                                                                                                                                          • Instruction ID: 8a8028a88a1267b23771365ad2bae8ac642df27304e0506721fcc1a2e735f1fc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 606ed7b1692c76c641d5613d1b6d66393b10fb6f7be18d701976a0a0b2ea412d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF11CE63749610C1FE019BAAFC0835563A2BB09BE8F88546A9D1C06734DF3EC959C360
                                                                                                                                                                                                          Function 00007FF654CA15E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                          • String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                          • API String ID: 384173800-1835852900
                                                                                                                                                                                                          • Opcode ID: e6b7f3097ed1fa55bbfab8c2ac934be5e0bcb191cc89f52011f527b87621e30f
                                                                                                                                                                                                          • Instruction ID: 1f0784ae3fc797d470a0edd04e01738fd937e673f3f285ace8211833898c514f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6b7f3097ed1fa55bbfab8c2ac934be5e0bcb191cc89f52011f527b87621e30f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B701BAA4A4AA5B91EA119B06F9A017423B4AF88794F8C41B3C84EE7364EF2CE546C300
                                                                                                                                                                                                          Function 66FA1C30 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: callocfree
                                                                                                                                                                                                          • String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
                                                                                                                                                                                                          • API String ID: 306872129-3913984646
                                                                                                                                                                                                          • Opcode ID: f7497d6656fa43165a627de98dea7d9b3e09a65f69f9b472af60d34e42e87eec
                                                                                                                                                                                                          • Instruction ID: cadfe95afb1ccc79284d72b2fdcd415659d98b5f5ec100a438c8503d216c4bd5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f7497d6656fa43165a627de98dea7d9b3e09a65f69f9b472af60d34e42e87eec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C34145763187C0CAFB70CF15E8807DAB7A5F388798F40421ACA984BA98DBBDD045CB51
                                                                                                                                                                                                          Function 66F8E6A0 Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Mem_$Free$FromList_MallocMarshal_ObjectPy_fstat_noraiseReadStringfread
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 308550609-0
                                                                                                                                                                                                          • Opcode ID: 173b2679fa090a7d00211a9dfe8eec30b66ab2835932efa8dd22830a9bffd1aa
                                                                                                                                                                                                          • Instruction ID: 2b605346f52c3a10455e0f0c87876471b95143797fa09b5225297ca7475f13a4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 173b2679fa090a7d00211a9dfe8eec30b66ab2835932efa8dd22830a9bffd1aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98218D32B19B8085FA118B65F848369A774EBC6BEDF480129EE5D47B65DF3CC195C700
                                                                                                                                                                                                          Function 00007FF654CA6520 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 157COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                          • API String ID: 1294909896-1126984729
                                                                                                                                                                                                          • Opcode ID: f715ec876722e12cdb0f662df770872b06380997f3a1ed7aba2766a90e7ae60b
                                                                                                                                                                                                          • Instruction ID: 9643b123931b93ecfc1a13828861565f0810a3f814ace5edbc3fe8db6b0e578e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f715ec876722e12cdb0f662df770872b06380997f3a1ed7aba2766a90e7ae60b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7071FAB6618A4695EB109F62E8A83693370FB88F85F488073DE5EA7364DF3CD509C740
                                                                                                                                                                                                          Function 66FFF950 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • VirtualProtect failed with code 0x%x, xrefs: 66FFFADA
                                                                                                                                                                                                          • VirtualQuery failed for %d bytes at address %p, xrefs: 66FFFB28
                                                                                                                                                                                                          • Address %p has no image-section, xrefs: 66FFFB39
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: QueryVirtual
                                                                                                                                                                                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                                                                                                                                                          • API String ID: 1804819252-2123141913
                                                                                                                                                                                                          • Opcode ID: 98524c9a6126829ac2c8b2cde8f722641c52e9f3b3b3acac046996fe8f5d46c9
                                                                                                                                                                                                          • Instruction ID: 4a09a67f79bf3fe13deff55902b245e799be2e601cabb264a2af125825f7cdcd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98524c9a6126829ac2c8b2cde8f722641c52e9f3b3b3acac046996fe8f5d46c9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0151CF73B26B41C6EB508F25E84079D77A2B788BA8F498226DE2D477A4DB38C546C310
                                                                                                                                                                                                          Function 00007FFDFB132405 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _stricmpstrchrstrncmp
                                                                                                                                                                                                          • String ID: ..\s\crypto\store\store_lib.c$T$file
                                                                                                                                                                                                          • API String ID: 3017659097-909561481
                                                                                                                                                                                                          • Opcode ID: 503d7c060f9ca88cb13353a6b662c23f936918faa0af8a7225bb6e83a0b4d6aa
                                                                                                                                                                                                          • Instruction ID: 0ac58eb0b34d2e6c00ccb214ed3e6be47ae9a331909e9d6a8962aa64a6440621
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 503d7c060f9ca88cb13353a6b662c23f936918faa0af8a7225bb6e83a0b4d6aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 84419432B4AA5796EB11EF11E8609A973A4FB89B88F444035DE5D077E8EF3CE545C700
                                                                                                                                                                                                          Function 00007FF654CA7490 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
                                                                                                                                                                                                          • String ID: _MEIPASS2
                                                                                                                                                                                                          • API String ID: 3789554339-3944641314
                                                                                                                                                                                                          • Opcode ID: 32073048c59e9077f6f36a3fca34749367cfe369c6483e236f106b3387b7c847
                                                                                                                                                                                                          • Instruction ID: beaedefb14458b0954ffeb20603008eba5b88a3865c958cf3aaa40ff8adcf9fd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 32073048c59e9077f6f36a3fca34749367cfe369c6483e236f106b3387b7c847
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3521D0D2B4954244EA10A613A8A46BA52B2BFC5BE0FCC85B3ED1DA77C6ED3CD4458314
                                                                                                                                                                                                          Function 66F89800 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • recursion limit exceeded, xrefs: 66F89F40
                                                                                                                                                                                                          • EOF read where object expected, xrefs: 66F898C7
                                                                                                                                                                                                          • bad marshal data (unknown type code), xrefs: 66F89F17
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_String
                                                                                                                                                                                                          • String ID: EOF read where object expected$bad marshal data (unknown type code)$recursion limit exceeded
                                                                                                                                                                                                          • API String ID: 1450464846-1585441539
                                                                                                                                                                                                          • Opcode ID: 2752d80ef754a57dd89e269fd23386fa7e4a22bd889e594f6e97b0ecfba3df9e
                                                                                                                                                                                                          • Instruction ID: 69397e9ce6372de11e6ffdb94e1ddc9aec278d808e0419eb0358cd18c94b7750
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2752d80ef754a57dd89e269fd23386fa7e4a22bd889e594f6e97b0ecfba3df9e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA318B32218A85C1FB21CF1DE8843A97371FB987A9F919525DE5E173A0DF39C196C350
                                                                                                                                                                                                          Function 00007FF654CA5910 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen
                                                                                                                                                                                                          • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                                                                                                                                                                                          • API String ID: 39653677-2762566162
                                                                                                                                                                                                          • Opcode ID: d933acb19d688c888bbabfb13c8229aa91e53fac741f948bdaf742cd5b545c31
                                                                                                                                                                                                          • Instruction ID: 257fbcc23c0b2da53f40a2928bfc369a0eb1dba8bb13b3ef2f7d882ebe2718e4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d933acb19d688c888bbabfb13c8229aa91e53fac741f948bdaf742cd5b545c31
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F11133A6E0991685FA00DB6AE8A40A96370AFC4FD4B8C8173DD1DE7761EE3CE546C700
                                                                                                                                                                                                          Function 66F89C30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (bytes object size out of range), xrefs: 66F8A97D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Bytes_Err_FromOccurredSizeStringmemcpy
                                                                                                                                                                                                          • String ID: bad marshal data (bytes object size out of range)
                                                                                                                                                                                                          • API String ID: 2675459810-66224825
                                                                                                                                                                                                          • Opcode ID: 8b815e33c6a9e9321f1ac26222c8e409a2144161d952660b83f976bbb467b547
                                                                                                                                                                                                          • Instruction ID: 6e6b5267d098d4ed37c503bf90278393d3bfa6a41325dfc64eb33c1c2f428f16
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8b815e33c6a9e9321f1ac26222c8e409a2144161d952660b83f976bbb467b547
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99113A32309690C6EA14DB19D488B1A3376F799B84F518599CE1E0B358DF39D546C390
                                                                                                                                                                                                          Function 66F905D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Number_$DeallocErr_InvertNegativePositiveString
                                                                                                                                                                                                          • String ID: Invalid operator
                                                                                                                                                                                                          • API String ID: 4031754375-2676212410
                                                                                                                                                                                                          • Opcode ID: 97daef6cd2902c1118f03a607b0348390dd8c4d7e0cdc8180edd343b47f8e1ea
                                                                                                                                                                                                          • Instruction ID: 2afa321a4b2a6e7066d765ad370a2a957ca1bba1e3a9790e62ee440b756d5ea1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 97daef6cd2902c1118f03a607b0348390dd8c4d7e0cdc8180edd343b47f8e1ea
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2F06232668900D1FE548F79E84832D6372A7CBB5DF450619D92D42275CFB9C1D4CBA1
                                                                                                                                                                                                          Function 00007FFDFB1346C9 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 217COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memmove
                                                                                                                                                                                                          • String ID: )$..\s\crypto\evp\p5_crpt.c$assertion failed: EVP_CIPHER_iv_length(cipher) <= 16$assertion failed: EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
                                                                                                                                                                                                          • API String ID: 2162964266-3025833483
                                                                                                                                                                                                          • Opcode ID: d4c1e3f06c2810839b8112079928d9e6766f37ae9ec5cf3b44562ddb7b1bd44c
                                                                                                                                                                                                          • Instruction ID: 04eee987a736165c46177c7e860c9a6663074601ea587c27a7bda678321cc069
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d4c1e3f06c2810839b8112079928d9e6766f37ae9ec5cf3b44562ddb7b1bd44c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 49919762F1E94749EB60EB1594A1FBA6390EF447C4F449031E96D87AEDEF3CE4458B00
                                                                                                                                                                                                          Function 67000B20 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _stat64$freemallocmemcpystrlen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4289191721-0
                                                                                                                                                                                                          • Opcode ID: 80b34f1c5fdd88b2ce448e724f3a28e93e51d86314deed038756465e35ae143c
                                                                                                                                                                                                          • Instruction ID: f062ce7101a7301369fca3413351cf8643b74da5f83adf6f5a57257d18a817f8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 80b34f1c5fdd88b2ce448e724f3a28e93e51d86314deed038756465e35ae143c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9519E3212C69088F7108F21909076E77E6E79EBB8F548012DBA407759DB7EC085C762
                                                                                                                                                                                                          Function 00007FF654CA76B0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 102stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$ByteCharMultiWidefreememsetstrcpystrtok
                                                                                                                                                                                                          • String ID: WARNING: file already exists but should not: %s
                                                                                                                                                                                                          • API String ID: 901113649-146164175
                                                                                                                                                                                                          • Opcode ID: 7072ae6d0657243b1b059db1da13a8eaa9e493386cd5a882feb7df409dbc5b21
                                                                                                                                                                                                          • Instruction ID: f7f63d71ed15e4af07ef2cc17e75bf3c3cc54be8e5d1a378b3937fb2516d657b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7072ae6d0657243b1b059db1da13a8eaa9e493386cd5a882feb7df409dbc5b21
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA31A091B4954244FA21E713E8A57FA52626FC5BC4F8C40B3ED0DE77C6DE2CE149C650
                                                                                                                                                                                                          Function 00007FFDFB35FA80 Relevance: 9.1, APIs: 7, Instructions: 327stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • strchr.VCRUNTIME140(?,00000000,?,00007FFDFB35F9EB,?,?,00000000,00007FFDFB35EF27), ref: 00007FFDFB35FB9A
                                                                                                                                                                                                          • strchr.VCRUNTIME140(?,00000000,?,00007FFDFB35F9EB,?,?,00000000,00007FFDFB35EF27), ref: 00007FFDFB35FBC8
                                                                                                                                                                                                          • strchr.VCRUNTIME140(?,00000000,?,00007FFDFB35F9EB,?,?,00000000,00007FFDFB35EF27), ref: 00007FFDFB35FBDC
                                                                                                                                                                                                          • strchr.VCRUNTIME140(?,00000000,?,00007FFDFB35F9EB,?,?,00000000,00007FFDFB35EF27), ref: 00007FFDFB35FDB4
                                                                                                                                                                                                          • strchr.VCRUNTIME140(?,00000000,?,00007FFDFB35F9EB,?,?,00000000,00007FFDFB35EF27), ref: 00007FFDFB35FDC4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strchr
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2830005266-0
                                                                                                                                                                                                          • Opcode ID: b47ed86f5467abe1a2b598f8d36dc161c19d63e871b7563a1b6bed335e2f929c
                                                                                                                                                                                                          • Instruction ID: 584477234f7b2e9b259b099500e5c3da6cb3cc254591e764dcdc37ef7395dea6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b47ed86f5467abe1a2b598f8d36dc161c19d63e871b7563a1b6bed335e2f929c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9EB12022B4A58743FB51AB29D0A4A7863D1EB45BA0F494131DF6C477EADE2DFCC68300
                                                                                                                                                                                                          Function 66F8FB90 Relevance: 9.1, APIs: 6, Instructions: 72COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Dict_Item$Eval_Globals
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 298195719-0
                                                                                                                                                                                                          • Opcode ID: bdbfbde53943e06cb84977794a913d9a8feaca20f0af7cd8f2ba57cf1041ecb5
                                                                                                                                                                                                          • Instruction ID: 10d891a56c4b4db0109e04e10b0597b56b96162e53721a7f69e0ea27a5975be5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bdbfbde53943e06cb84977794a913d9a8feaca20f0af7cd8f2ba57cf1041ecb5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3119162F6B6118BFE8AA7567C143850062ABDABD9F5E8469CC0D06715EA28CBD3C210
                                                                                                                                                                                                          Function 00007FF654CA75D0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: wcscatwcscmp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3846154227-0
                                                                                                                                                                                                          • Opcode ID: 2e846096d5f1173c00e44c6aa62fcc8cda5cfbe0eb3fb93c179b8cb843208025
                                                                                                                                                                                                          • Instruction ID: dc6887e6ccc5f1225daad81d0523fa5e873dcda5db4dd2fa1c2f15dd1e19a61b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e846096d5f1173c00e44c6aa62fcc8cda5cfbe0eb3fb93c179b8cb843208025
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4116DD0B8D54345FA59AB2798B43B912B16FC4BC4F4C80B3DD0EE6282EE2CE5068224
                                                                                                                                                                                                          Function 66F8F4E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Failed to alloc memory for spp code, xrefs: 66F8F72B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocVirtualexitmemcpy
                                                                                                                                                                                                          • String ID: Failed to alloc memory for spp code
                                                                                                                                                                                                          • API String ID: 693558432-822294455
                                                                                                                                                                                                          • Opcode ID: f3bc23246e1a7ea39ca5eeb61b5eab4d2a1b7311cb43689520820e0dc14aebbb
                                                                                                                                                                                                          • Instruction ID: fec435337d9191e434979fca2facb34d50444232d1990e8d9ceb768e064c7e84
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3bc23246e1a7ea39ca5eeb61b5eab4d2a1b7311cb43689520820e0dc14aebbb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99518BB2B16B4486EF948F09E88075873B5FB89BD8F54812ADE5C477A4EF38C061C310
                                                                                                                                                                                                          Function 00007FF654CB2378 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fwprintf$fputwc
                                                                                                                                                                                                          • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                          • API String ID: 2988249585-4054516066
                                                                                                                                                                                                          • Opcode ID: b02ba0fa6d73b1136932df1615eabb89f2fc48cd2a4aa50ad3fcf4feca9b3b31
                                                                                                                                                                                                          • Instruction ID: 56f9b3c771380ba5e434f42c949319a640f5cf67ea75b5c02e06c19b2a15a7b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b02ba0fa6d73b1136932df1615eabb89f2fc48cd2a4aa50ad3fcf4feca9b3b31
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9671FCB6A04B89CADB24CF2AC4945AC77F0F788B9CB458566EE4D97B58DF38D400CB40
                                                                                                                                                                                                          Function 00007FF654CA6F10 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strlen$malloc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3157260142-0
                                                                                                                                                                                                          • Opcode ID: 0419613c3ea4f464a99d91cc0fc2a83583cd7a599b744298bfe001e261bbff0e
                                                                                                                                                                                                          • Instruction ID: 649894e7a07060035aba572be40f29fdaeebe30295591872a16ee8c8711d47b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0419613c3ea4f464a99d91cc0fc2a83583cd7a599b744298bfe001e261bbff0e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4311C282B0A14208FC5AEA5359F47BB45A11FD5FD8D8C80B2ED4DAB781FE3CA4468360
                                                                                                                                                                                                          Function 66F90225 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • catching classes that do not inherit from BaseException is not allowed, xrefs: 66F90365
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$DeallocExceptionGivenMatchesSizeStringTuple_
                                                                                                                                                                                                          • String ID: catching classes that do not inherit from BaseException is not allowed
                                                                                                                                                                                                          • API String ID: 1667255942-1287988286
                                                                                                                                                                                                          • Opcode ID: 7aa5052ace1f0b2f986bcb667602ca640b41220727e23121f6c32aab47bdbf06
                                                                                                                                                                                                          • Instruction ID: 813c8e1707d8b2129448e4b63dbce8df304fb9c700ee6787fb423eed43f35ed2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7aa5052ace1f0b2f986bcb667602ca640b41220727e23121f6c32aab47bdbf06
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7221CD73B09740C2FB088F36E484B597361A746F99F088229CE5C47360DFBAC195C380
                                                                                                                                                                                                          Function 66F907B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • No active exception to reraise, xrefs: 66F907DC
                                                                                                                                                                                                          • local variable referenced before assignment, xrefs: 66F907FB
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$Format$Occurred
                                                                                                                                                                                                          • String ID: No active exception to reraise$local variable referenced before assignment
                                                                                                                                                                                                          • API String ID: 1084603930-1116140797
                                                                                                                                                                                                          • Opcode ID: ea755bf025dee667039df077fee257567cff1e322b8d29ae90c64374e7b485f0
                                                                                                                                                                                                          • Instruction ID: 5588140cc0f9ee580c6acc3bb115a1d8a3b10d05f1cf09ba4382bbcb72c72f03
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea755bf025dee667039df077fee257567cff1e322b8d29ae90c64374e7b485f0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4F08271B29705C2FF05CBA5E88435413A1AB48B79F950615CC1C47331DE6EC1EAC721
                                                                                                                                                                                                          Function 00007FFDFB133247 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 268stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memmovememsetstrncpy
                                                                                                                                                                                                          • String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
                                                                                                                                                                                                          • API String ID: 899670095-3422593365
                                                                                                                                                                                                          • Opcode ID: f899bb93a93083c1eed05d22a3c6f44b612f3e9b136a5c3ea0115cf8b111b2c6
                                                                                                                                                                                                          • Instruction ID: 56985a143d49d9970f34c8785794f0a7e223cc0dade8dbc4825bc511f434e4db
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f899bb93a93083c1eed05d22a3c6f44b612f3e9b136a5c3ea0115cf8b111b2c6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8B1BF22B4A68786EB11AB159460F7ABBD0EB44B98F084135EE6D477F9DF3CF4848740
                                                                                                                                                                                                          Function 00007FFDFB135362 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memmove
                                                                                                                                                                                                          • String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
                                                                                                                                                                                                          • API String ID: 2162964266-3733131234
                                                                                                                                                                                                          • Opcode ID: 8a61b3c6a358ae9897c4f46a3d158109fb8a417a44eb08eaed83332f1f5fbda0
                                                                                                                                                                                                          • Instruction ID: d7fc9878e87224e5ed1804240bb3e724aa43c044b0cb9fd21aeeae3826b38d28
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8a61b3c6a358ae9897c4f46a3d158109fb8a417a44eb08eaed83332f1f5fbda0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6719266B0EA8386E720AB51E464BAE6390FB48798F440135DA6D83AEDDF3CD541CB40
                                                                                                                                                                                                          Function 66F925E0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 109stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: sprintfstrlen
                                                                                                                                                                                                          • String ID: ../src/platforms/windows/hdinfo.c$/%d:$No any serial number of harddisk got
                                                                                                                                                                                                          • API String ID: 1090396089-4267867539
                                                                                                                                                                                                          • Opcode ID: 31af2e46d4100cef63581085d68aae10d157700d2eb2dcb07bbe34cfb56b77b0
                                                                                                                                                                                                          • Instruction ID: 742a196d2347dd3a3586fae40d01f78c0c089f7c2c1a705e0f5f4cbf93905f9e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 31af2e46d4100cef63581085d68aae10d157700d2eb2dcb07bbe34cfb56b77b0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 00315A53F794504AFB118A79AC507AD2612B757BE9F884321CE2487BC4DA3B85D6C701
                                                                                                                                                                                                          Function 66F91570 Relevance: 7.6, APIs: 5, Instructions: 100COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PyFunction_NewWithQualName.PYTHON38 ref: 66F915BC
                                                                                                                                                                                                          • _Py_Dealloc.PYTHON38 ref: 66F91647
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeallocFunction_NameQualWith
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2691592392-0
                                                                                                                                                                                                          • Opcode ID: c70d8e22b6fb7d042fcbe835daa285448b2ec46c728d816a336a837257fbbf6c
                                                                                                                                                                                                          • Instruction ID: bd5bf38e3743a5e35916c73aa4263de51001008af231bea976bcc660219758d5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c70d8e22b6fb7d042fcbe835daa285448b2ec46c728d816a336a837257fbbf6c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 21316C33E45A40C3FA1ADF66AA4832972ADE756BD8F1D4631DF2946B14EF34C1A1C310
                                                                                                                                                                                                          Function 66FA0E50 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: N != NULL$src/math/rand_prime.c
                                                                                                                                                                                                          • API String ID: 0-3192267683
                                                                                                                                                                                                          • Opcode ID: e74fbf1bd119aaad982333372bbeefe55aa80f3d0b2425a64a8d787a8178b8b6
                                                                                                                                                                                                          • Instruction ID: 71ca21f85ae5edf2623e403285006933e7af733d431e057c60e540391ee86b9f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e74fbf1bd119aaad982333372bbeefe55aa80f3d0b2425a64a8d787a8178b8b6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E312463B08744CAFB248B16BC40B9E3B65E74ABEDF444129EE195BB94DF78C445C380
                                                                                                                                                                                                          Function 66F89E90 Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 66F88810: _PyFloat_Unpack8.PYTHON38 ref: 66F88841
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89EB4
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89F8D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Occurred$Float_Unpack8
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3006406168-0
                                                                                                                                                                                                          • Opcode ID: 25731e8754741c7258dcfdee3108278f9bf8a38bd790017d729a2d3f56006a67
                                                                                                                                                                                                          • Instruction ID: 7d0e9f83372ef69f9df16c3a787aed8ebe06486e262c1aff32f8199a6f3536fc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 25731e8754741c7258dcfdee3108278f9bf8a38bd790017d729a2d3f56006a67
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C11AF326486408AF615CF69D05C71B3376FF66790F02A689C90A27268DF3AD686C380
                                                                                                                                                                                                          Function 66F89D23 Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 66F88C60: memcpy.MSVCRT ref: 66F88CB9
                                                                                                                                                                                                            • Part of subcall function 66F88C60: PyOS_string_to_double.PYTHON38 ref: 66F88CCB
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89D47
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89FED
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Occurred$S_string_to_doublememcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 282781714-0
                                                                                                                                                                                                          • Opcode ID: c8eec1e2fb1afbe17f492ddba1688786fa44dcf2a18facbc5d00873f2a2d5e28
                                                                                                                                                                                                          • Instruction ID: 65021048e7727b8493c275957d86722a43481ffe7c7336157c345fb2bec24998
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8eec1e2fb1afbe17f492ddba1688786fa44dcf2a18facbc5d00873f2a2d5e28
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9911AF326096408BF615CF69D09C71B3376FFA6790F42A689890A36258DF3AE582C390
                                                                                                                                                                                                          Function 00007FF654CA8310 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone, xrefs: 00007FF654CA8312
                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442, xrefs: 00007FF654CA8311
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$ByteCharMultiWidecalloc
                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\jone$C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip;C:\Users\user\AppData\Local\Temp\_MEI73442\lib-dynload;C:\Users\user\AppData\Local\Temp\_MEI73442
                                                                                                                                                                                                          • API String ID: 3975185072-1692260131
                                                                                                                                                                                                          • Opcode ID: 0faf44b2c5f354340a62e8afc208ffbb73008dc180b0d557f08b18528392ab49
                                                                                                                                                                                                          • Instruction ID: ea8859a47de0189c25ce6c3eff647eb959316f7f7659f11613ca6d79bf32b054
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0faf44b2c5f354340a62e8afc208ffbb73008dc180b0d557f08b18528392ab49
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 890166A2F1661142FA21D71AA9A03B961609FC47D4F8C4472CF4E93780EE3CE481C320
                                                                                                                                                                                                          Function 00007FF654CA2920 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1200242243-0
                                                                                                                                                                                                          • Opcode ID: 89cb7d82cb1b40587ec4d78b90bde32f8ec055dd5bdbf5a296f83f89b3663874
                                                                                                                                                                                                          • Instruction ID: cc460658e1ce59e7c95f55528b7dd1d069b67309fb220763fa14eefccef88c29
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 89cb7d82cb1b40587ec4d78b90bde32f8ec055dd5bdbf5a296f83f89b3663874
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5901C0A0E1D17B42F65CA33778E56BC11B1AFD9B11F9C44B3D94FE5B988C2C68C24201
                                                                                                                                                                                                          Function 66FDD510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: abortfwrite
                                                                                                                                                                                                          • String ID: '$illegal index register
                                                                                                                                                                                                          • API String ID: 1067672060-451399654
                                                                                                                                                                                                          • Opcode ID: 30ed7b924fe86d56e32075ecd28e360c321c5069fcfad807037309b7bfbb4194
                                                                                                                                                                                                          • Instruction ID: 0726b703c7262fa3e2ce39de831f5f1432f6725bbb19c518c08dad537baa04bb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30ed7b924fe86d56e32075ecd28e360c321c5069fcfad807037309b7bfbb4194
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D691AC7361AB89C5EB128F3DE880A4C3FA5E3A5F88B9AC112CB4C47714CA7ED456C710
                                                                                                                                                                                                          Function 00007FF654CAD850 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: CCG
                                                                                                                                                                                                          • API String ID: 0-1584390748
                                                                                                                                                                                                          • Opcode ID: a2009b416c13826995d1c9318a92a1b9d2e4341e694bba52663129bfcb9c8ac9
                                                                                                                                                                                                          • Instruction ID: 26bed0aa39a31060e47e90cc69aba9865991b2ed665222cafed5457c9debdff5
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2009b416c13826995d1c9318a92a1b9d2e4341e694bba52663129bfcb9c8ac9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 734175B6A096028AF7208B65C4E43BC3272EFC5718F188677CA2DE77D4DE3CD9419241
                                                                                                                                                                                                          Function 66F8F750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81memoryfileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • Failed to alloc memory for bcc code, xrefs: 66F8F847
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocVirtualfwritememcpy
                                                                                                                                                                                                          • String ID: Failed to alloc memory for bcc code
                                                                                                                                                                                                          • API String ID: 1603020442-783995166
                                                                                                                                                                                                          • Opcode ID: eb23d3be20123cf0cf08d2a85a5079c95ad4c67ffd96b2f544d334d3cac980b3
                                                                                                                                                                                                          • Instruction ID: 31a1d8baf03bd5c1194be895fe23854d1f9c9f6b13b733042da3f3a37fb28dff
                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb23d3be20123cf0cf08d2a85a5079c95ad4c67ffd96b2f544d334d3cac980b3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB218BB2706B548AEB548F1AE84076877A4F70CFE9F48852ADF4C83750EB38C0A2C350
                                                                                                                                                                                                          Function 66F899D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • bad marshal data (string size out of range), xrefs: 66F8A06F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$OccurredString
                                                                                                                                                                                                          • String ID: bad marshal data (string size out of range)
                                                                                                                                                                                                          • API String ID: 114435612-3115314950
                                                                                                                                                                                                          • Opcode ID: 293430a6a5cdbc98a50b289ced698e2fed51f9bd8b8da540c01d7127c9aae8e1
                                                                                                                                                                                                          • Instruction ID: 3b4414d1bb201c171486ede7135525884a4aec373d10d333502f3ec199fbf4d9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 293430a6a5cdbc98a50b289ced698e2fed51f9bd8b8da540c01d7127c9aae8e1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E11063370568486FA12CF08E84439A63B1FF88BA5F018168CE1D177A8EF3DD586C350
                                                                                                                                                                                                          Function 00007FF654CA2C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00007FF654CA8210: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF654CA2E40), ref: 00007FF654CA8246
                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF654CA2C93
                                                                                                                                                                                                          • MessageBoxA.USER32 ref: 00007FF654CA2CBB
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                          • String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
                                                                                                                                                                                                          • API String ID: 1878133881-785100509
                                                                                                                                                                                                          • Opcode ID: f8b2052244f997f8cf142d2b4763022da063b563fc09b0a30e2edc3fc9052039
                                                                                                                                                                                                          • Instruction ID: 7dc9d71577be989c89177034a91cf21993150ee6a6a911859f43416f3186c8a1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8b2052244f997f8cf142d2b4763022da063b563fc09b0a30e2edc3fc9052039
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0801F5B279879041FB345B62B8547FA6290BB89FD8F888035CE4D67B85CD3DD5858B40
                                                                                                                                                                                                          Function 66F82ECE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Formatexit
                                                                                                                                                                                                          • String ID: %s (%d:%d)$\(
                                                                                                                                                                                                          • API String ID: 2212715685-1109738240
                                                                                                                                                                                                          • Opcode ID: 0424d5ceef1ab17d7a6ad8fdbdb3027b58ed43a9019e03873f4a971e827090bd
                                                                                                                                                                                                          • Instruction ID: b4f2ff009cb8151a99e9bd8b925fe9c212c5883eeda4a26a5ec718530b71c56f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0424d5ceef1ab17d7a6ad8fdbdb3027b58ed43a9019e03873f4a971e827090bd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60112573366B8485FB01CB19E88435A3771E789BA8F855556CD2D0B3A0CF3DC182C790
                                                                                                                                                                                                          Function 66F89D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_$String$Occurred
                                                                                                                                                                                                          • String ID: bad marshal data (invalid reference)
                                                                                                                                                                                                          • API String ID: 1118661901-2759865940
                                                                                                                                                                                                          • Opcode ID: 968cbeb75552fe5edac8bad04cde3dbc9d27da8db6f20704d605a970f4c42716
                                                                                                                                                                                                          • Instruction ID: b06c9a209ed7e0daf4cbee7a6fc9ff459a6e727a8ad181e6784ab6267fcdceb2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 968cbeb75552fe5edac8bad04cde3dbc9d27da8db6f20704d605a970f4c42716
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB111E72318A41C6FB04CF29D88871A3376F749BA4F529685CA2E173A4CF3AD5A5C790
                                                                                                                                                                                                          Function 00007FF654CA42F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                          • API String ID: 1532159127-1977442011
                                                                                                                                                                                                          • Opcode ID: f4bf1276b97d64210b6653597ec094bb76e5d053494305fba7f19c3c38b4cda7
                                                                                                                                                                                                          • Instruction ID: e4688c0613782778e6b8853051936c5d7a0aef4b84b9e59e4f6a74800fa88d29
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4bf1276b97d64210b6653597ec094bb76e5d053494305fba7f19c3c38b4cda7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53F0AFD1B1C15392FA556622A8B53F902B1AFC47C4F8C40B3D84EE67C6DD0EE5469310
                                                                                                                                                                                                          Function 66F91B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • ../src/platforms/windows/hdinfo.c, xrefs: 66F91B80
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorFormatFreeLastLocalMessage
                                                                                                                                                                                                          • String ID: ../src/platforms/windows/hdinfo.c
                                                                                                                                                                                                          • API String ID: 1365068426-2451707101
                                                                                                                                                                                                          • Opcode ID: 0b3497e0e8524aa34434791428da8e05064aec6413ab9b7d1de309c9d65537ca
                                                                                                                                                                                                          • Instruction ID: 8dce6f37feef62638acdf1acdd4dcdb0bf3105246173f09d06f6fee41ccbe511
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b3497e0e8524aa34434791428da8e05064aec6413ab9b7d1de309c9d65537ca
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CF03032308A40C1E7509B21E81934AB772F3D9B89F504115DB8D43BA4DF3EC2598B50
                                                                                                                                                                                                          Function 00007FFDFB34E9B0 Relevance: 6.5, APIs: 5, Instructions: 218COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memcmp
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1475443563-0
                                                                                                                                                                                                          • Opcode ID: 8f8bb78f2a2637a729eadb8f3da555a761f623b2f8a1b02fd96e3a6437f90bd1
                                                                                                                                                                                                          • Instruction ID: edcda4a4fc6805b4c69f288f9108b227c18234642f0aef9a55be72d804884ef3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f8bb78f2a2637a729eadb8f3da555a761f623b2f8a1b02fd96e3a6437f90bd1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9881B361B496A3C2FB24BA26D5609BE27E1BF447C8F445431CE2D5BAEDEE28E545C300
                                                                                                                                                                                                          Function 00007FFDFB132E4B Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 368COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memset
                                                                                                                                                                                                          • String ID: ..\s\crypto\sm2\sm2_crypt.c$@
                                                                                                                                                                                                          • API String ID: 2221118986-485510600
                                                                                                                                                                                                          • Opcode ID: da7dc45c9c2dfd3cf84d3af2843d57906763fb0a5865fcf3f3ae2116ab873b62
                                                                                                                                                                                                          • Instruction ID: cba4bc86651f4b022fa2b4343283962724a3770a4b60e332f76822fe4bb72fd4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: da7dc45c9c2dfd3cf84d3af2843d57906763fb0a5865fcf3f3ae2116ab873b62
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D5F16132B0EA8782EB20AB15E4609A967A0FF85BC8F484135DE9D477E9EF3DD545C700
                                                                                                                                                                                                          Function 00007FFDFB1E3450 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 164stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strncmp
                                                                                                                                                                                                          • String ID: content-type
                                                                                                                                                                                                          • API String ID: 1114863663-3266185539
                                                                                                                                                                                                          • Opcode ID: 4631d19e4425c0fd0a3489a558a41e6dd35230276ece1185163dec947c25b71f
                                                                                                                                                                                                          • Instruction ID: 6cda78ec5f4cfa1a6176f8cf96b9201f9266618bf075ad81cedba0819021ec3e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4631d19e4425c0fd0a3489a558a41e6dd35230276ece1185163dec947c25b71f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0519123F1EA4341FB629725A560B7A6291AF45BACF441230DE7E477EDEF2CE5428700
                                                                                                                                                                                                          Function 00007FFDFB13112C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: memmove
                                                                                                                                                                                                          • String ID: ..\s\crypto\ct\ct_oct.c
                                                                                                                                                                                                          • API String ID: 2162964266-1972679481
                                                                                                                                                                                                          • Opcode ID: 062cd3e64885ebfd0890634cdc10c5af027266595d2eae18cc88829b6952b2c6
                                                                                                                                                                                                          • Instruction ID: 4f017b744a4016e950ec9fff18767f3fe2a876819e6f84054ad22b7726625bbe
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 062cd3e64885ebfd0890634cdc10c5af027266595d2eae18cc88829b6952b2c6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1971A362B0E69289E715EF2580205BC3BA1FB15F44F084532DE6C477EADE2CE6D9C711
                                                                                                                                                                                                          Function 66F81010 Relevance: 6.1, APIs: 4, Instructions: 131sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Sleep_amsg_exit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1015461914-0
                                                                                                                                                                                                          • Opcode ID: e5702a439a4ad7f612bf09567f4b6bdbc3a59019ab1ed67d80b3c557a7c00de7
                                                                                                                                                                                                          • Instruction ID: 36f8baeecf6fe092316813967f0358202faac6b42ecc9b1c15b7995d41157d5a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e5702a439a4ad7f612bf09567f4b6bdbc3a59019ab1ed67d80b3c557a7c00de7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1441BE33B19A45CAF706CF5AEC907563376A7A8BD9F84416ACE2C87350EE39C491C360
                                                                                                                                                                                                          Function 66FA1AC0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • in != NULL, xrefs: 66FA1C19
                                                                                                                                                                                                          • src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 66FA1C12
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
                                                                                                                                                                                                          • API String ID: 0-85593093
                                                                                                                                                                                                          • Opcode ID: 5c52bab621110d91baed5af67f33942c581aa4e88befd0dd93c9ea70a8f3c3da
                                                                                                                                                                                                          • Instruction ID: fbac79a958a79ffb04a36821a58578e47854271ef9080731b78a1bea095f10be
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c52bab621110d91baed5af67f33942c581aa4e88befd0dd93c9ea70a8f3c3da
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E31E133B29784CBEB14CF29E810B9D7225E795BD9F994228DE4D4BB44EB39C451CB00
                                                                                                                                                                                                          Function 66F89400 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Bytes_Sizefwritememcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3636771336-0
                                                                                                                                                                                                          • Opcode ID: 093730332a7e9877e6b19efade14e0ea6c1ba5ef8ad62899f2d7a132981f3775
                                                                                                                                                                                                          • Instruction ID: 7fb8f1e4ecaeb01849937532973a0c10b29274815122a81459077c6be761d3af
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 093730332a7e9877e6b19efade14e0ea6c1ba5ef8ad62899f2d7a132981f3775
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F31A0A3745A5486EB05CF6AE94875823A1F39CFECF54812ADE2D1B788DE38C586C341
                                                                                                                                                                                                          Function 00007FFDFB1322CA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strcmp
                                                                                                                                                                                                          • String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
                                                                                                                                                                                                          • API String ID: 1004003707-3633731555
                                                                                                                                                                                                          • Opcode ID: 96a109f9c30092f0ab8764c48a0b78b03f30e2d1876c41eb359e8fe877bb5394
                                                                                                                                                                                                          • Instruction ID: 7bc10604b3afa7911df0726c473694393fb598a34031373e7794f2ac2072df6c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96a109f9c30092f0ab8764c48a0b78b03f30e2d1876c41eb359e8fe877bb5394
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E215322B0AA4B82EB10EB55E4609A9A3A0FF88784F544135EA5C87BEDFE7DD155C700
                                                                                                                                                                                                          Function 00007FF654CA2B10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                          • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                          • API String ID: 3219091393-982972847
                                                                                                                                                                                                          • Opcode ID: 8df6a8358dac60a212556b377cd368c0f9cc8a804325971415c7063dd2af1f98
                                                                                                                                                                                                          • Instruction ID: 45b0259018f5ba383fbd1b91b62b7673d542c93eb8ca9fedd33e035a73825927
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8df6a8358dac60a212556b377cd368c0f9cc8a804325971415c7063dd2af1f98
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51017191B5966206FD1DA5A719B2AFA50610FC5BD0D9C48B6ED0FABF82EC2CE4454310
                                                                                                                                                                                                          Function 66F89CD1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 66F88810: _PyFloat_Unpack8.PYTHON38 ref: 66F88841
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89CF1
                                                                                                                                                                                                          • PyFloat_FromDouble.PYTHON38 ref: 66F89FB4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Float_$DoubleErr_FromOccurredUnpack8
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4123378784-0
                                                                                                                                                                                                          • Opcode ID: 75cbe4f6236140e3f3e17949df3a7072b92d9d5fd2809eafefd520ee0c94fa05
                                                                                                                                                                                                          • Instruction ID: 27d32f8ea74f9d277b91601c6cedb36b2cba6cb8e9da901d03b1e33723779872
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75cbe4f6236140e3f3e17949df3a7072b92d9d5fd2809eafefd520ee0c94fa05
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41017133748200CBF614CF69D49CB1B7376FB55785F029588C91627268DF3AD581C790
                                                                                                                                                                                                          Function 66F89DD3 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 66F88C60: memcpy.MSVCRT ref: 66F88CB9
                                                                                                                                                                                                            • Part of subcall function 66F88C60: PyOS_string_to_double.PYTHON38 ref: 66F88CCB
                                                                                                                                                                                                          • PyErr_Occurred.PYTHON38 ref: 66F89DF3
                                                                                                                                                                                                          • PyFloat_FromDouble.PYTHON38 ref: 66F8A014
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DoubleErr_Float_FromOccurredS_string_to_doublememcpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1362591179-0
                                                                                                                                                                                                          • Opcode ID: b238720ab883d221391d78448b7b0e127067fece75bd79c02a78ff4f3cec0e5e
                                                                                                                                                                                                          • Instruction ID: e567c4af1fbd2cd196b2fd2dbc9fede7847cb61bbc0f2e85543c85b79b87e7e2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b238720ab883d221391d78448b7b0e127067fece75bd79c02a78ff4f3cec0e5e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 61017133745600CBF605CF25C49CB1B33BAFB55794F12AA98C90627254DF3AD582C780
                                                                                                                                                                                                          Function 66F89BD0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_FromLongLong_Occurred
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4098471257-0
                                                                                                                                                                                                          • Opcode ID: 49b78bd632a16342053534db293ba5be799141b1bf89e5b3197291154ee42b47
                                                                                                                                                                                                          • Instruction ID: 3a83104b59892f6198c9341ee6ea786cc49422b5610113c751f71647becea107
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49b78bd632a16342053534db293ba5be799141b1bf89e5b3197291154ee42b47
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E50128327496508BFA14CF68C49CB2B33B6FB85B81B429598C91A1B359DE3AD641C384
                                                                                                                                                                                                          Function 00007FFDFB131DD4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: getaddrinfo
                                                                                                                                                                                                          • String ID: ..\s\crypto\bio\b_addr.c
                                                                                                                                                                                                          • API String ID: 300660673-2547254400
                                                                                                                                                                                                          • Opcode ID: f3cfbca69420f5427df2d31b0fded41f4fb78145a65b2b5ca5eaac2b623b0e37
                                                                                                                                                                                                          • Instruction ID: b361f956b8c684cc923e67408492a74c28b4b66e2f7be0ba2f398166c024dba8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3cfbca69420f5427df2d31b0fded41f4fb78145a65b2b5ca5eaac2b623b0e37
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A941F873F1969387E7109B12A850AAD77A4FB84748F144035EA9E83BE9DF3CE844CB40
                                                                                                                                                                                                          Function 00007FF654CACDD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-3474627141
                                                                                                                                                                                                          • Opcode ID: 4b8c868c6939ec88d1abe8f8504a39c26f50d9ef9e938201b9fa1182f5e26e6d
                                                                                                                                                                                                          • Instruction ID: 160d08a1c4d8db08604566c55807b5423ddb61cdb3b3430b03f1b9281f6d1cac
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b8c868c6939ec88d1abe8f8504a39c26f50d9ef9e938201b9fa1182f5e26e6d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8215E66A04F849AD7128F68D8813E97371FF99798F484622EE8C67728DF38D255C300
                                                                                                                                                                                                          Function 66F880B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Err_Format
                                                                                                                                                                                                          • String ID: %s (%d:%d)
                                                                                                                                                                                                          • API String ID: 376477240-1595188566
                                                                                                                                                                                                          • Opcode ID: b3eb94625566ced6eae50b08347c60d5f23321d25285cdcded42f12e05cb6486
                                                                                                                                                                                                          • Instruction ID: fbd53ae8b92f25b70ab5e6e65fd5d64f7afccbd6fdcf3c2589c86460cb1a0f9e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3eb94625566ced6eae50b08347c60d5f23321d25285cdcded42f12e05cb6486
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64012B73E18B5485F701DB1CD8413893761EB99B98F9A4166CD7D173A2CF2DC982C390
                                                                                                                                                                                                          Function 00007FF654CA2E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message_errno
                                                                                                                                                                                                          • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                          • API String ID: 1796756983-2410924014
                                                                                                                                                                                                          • Opcode ID: 80f6f717bb9969ece7152c8fde9cb11b8c043fce6b7f1340054d38df66cc8f43
                                                                                                                                                                                                          • Instruction ID: 0f0c90e1c03a1cbd28842ec4c07fd859d7d71d6edf2705573b18a42781d13223
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 80f6f717bb9969ece7152c8fde9cb11b8c043fce6b7f1340054d38df66cc8f43
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7501A2A261CA8091E224DB11F8907EA6374FBC47C0F948132EFCD63B598E3CD246CB40
                                                                                                                                                                                                          Function 00007FFDFB13343B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767214909.00007FFDFB131000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFB130000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767197166.00007FFDFB130000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB13D000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB195000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1A9000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1BA000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1C0000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB1CE000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767214909.00007FFDFB371000.00000020.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB373000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB39E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3CF000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB3F5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767491014.00007FFDFB41A000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767756432.00007FFDFB441000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767781456.00007FFDFB447000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB449000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB465000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767805120.00007FFDFB469000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ffdfb130000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _time64
                                                                                                                                                                                                          • String ID: !$..\s\crypto\ct\ct_policy.c
                                                                                                                                                                                                          • API String ID: 1670930206-3401457818
                                                                                                                                                                                                          • Opcode ID: d9f64f4cc04cddd85ee12494419b894aad7291cbd22d4c8079ebbf3f97d39cc8
                                                                                                                                                                                                          • Instruction ID: 899f6c599aa421064b5e49b4e2e628cd99e94ccf8fe843189f4d89d2b43ba9a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d9f64f4cc04cddd85ee12494419b894aad7291cbd22d4c8079ebbf3f97d39cc8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 10F06232B57A0786FB149B24E421BAD6390EF50714F580435DA2D463F9EE3CE796C740
                                                                                                                                                                                                          Function 00007FF654CACE29 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2468659920
                                                                                                                                                                                                          • Opcode ID: 50bb6e3b89c3acdd8da2640c7def1cf69755cc37c592828175fc8adef2d15e3e
                                                                                                                                                                                                          • Instruction ID: 5ff4d119244352cb4b47f4a5cee92e8a1fd84872159f6b7ed742f4f700e91d03
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 50bb6e3b89c3acdd8da2640c7def1cf69755cc37c592828175fc8adef2d15e3e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E01B166904F888AD711CF69C8802AA3330FF8D798F488322EF8C27724DF28C184C300
                                                                                                                                                                                                          Function 00007FF654CACE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2713391170
                                                                                                                                                                                                          • Opcode ID: 3ea1ec97f37694b9006fc54621547460099b2c1b8ca40b1c9d9b39adf94a092d
                                                                                                                                                                                                          • Instruction ID: 9a56ce93665c2303d4ab2f912c12740723eec1c522abf357ec411255b23e2c6a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea1ec97f37694b9006fc54621547460099b2c1b8ca40b1c9d9b39adf94a092d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C501B166904F888AD711CF69C8902AA3330FF8D799F484322EF8C27724DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4273532761
                                                                                                                                                                                                          • Opcode ID: 48690192945bf7f32f1c5466faad3cff15a9c142b134f494af273dc6dbb7eaa3
                                                                                                                                                                                                          • Instruction ID: 29756801927750c44cda4c2788db84519a6c331a57eeaa591c7bb19d9feb123c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48690192945bf7f32f1c5466faad3cff15a9c142b134f494af273dc6dbb7eaa3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C01B166904F888AD712CF29C8802AA3334FF8D798F488322EF8C27764DF28C185C300
                                                                                                                                                                                                          Function 00007FF654CACE43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4283191376
                                                                                                                                                                                                          • Opcode ID: 671409083fba1ed317bee3cf4e306283cdb16a53cc92c70d1fd336fd5438df01
                                                                                                                                                                                                          • Instruction ID: 983412851e244faf7d01a7a946043e183935905247246f44830078ee0125b515
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 671409083fba1ed317bee3cf4e306283cdb16a53cc92c70d1fd336fd5438df01
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2901B166904F888AD711CF29C8902AA3330FF8D798F484722EF8C27724DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE36 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-4064033741
                                                                                                                                                                                                          • Opcode ID: 74916eb7a76916125411d7b1f6d0d259c89befd042e1e24e2dfbcfe61768ada9
                                                                                                                                                                                                          • Instruction ID: 60de4da7dd1c44de1050296ae39041b32620e19bdb2a7de74b7412cd955e8f8b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 74916eb7a76916125411d7b1f6d0d259c89befd042e1e24e2dfbcfe61768ada9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA01B166904F888AD711CF29C8902AA3330FF8D798F484322EF8C67764DF28C144C300
                                                                                                                                                                                                          Function 00007FF654CACE5D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: fprintf
                                                                                                                                                                                                          • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                          • API String ID: 383729395-2187435201
                                                                                                                                                                                                          • Opcode ID: 828440ead5f24b7a3bcef289b9b0c651ba51a82a4e2612c4078c08dbf4f376dd
                                                                                                                                                                                                          • Instruction ID: fb016fedc043421df838e72b29ba9651d528aa472941d7cb9bfbb3d4e921c6d2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 828440ead5f24b7a3bcef289b9b0c651ba51a82a4e2612c4078c08dbf4f376dd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB019E66904F888AD7128F29C8802AA3330FF8D798F484322EF8C27724DF28C185C300
                                                                                                                                                                                                          Function 66F9D070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 66F9D086
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __iob_funcabort
                                                                                                                                                                                                          • String ID: LTC_ARGCHK '%s' failure on line %d of file %s
                                                                                                                                                                                                          • API String ID: 1307436159-2823265812
                                                                                                                                                                                                          • Opcode ID: 6c95e00e63d74bb15555f1f84c7ed5e16dc274d1385497de8ee2477182e8e9e6
                                                                                                                                                                                                          • Instruction ID: 958e54fbe73cadcdac70deab316540e8ce6e1ef0407032b64e17f0651719fcb9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c95e00e63d74bb15555f1f84c7ed5e16dc274d1385497de8ee2477182e8e9e6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFD02E2022869890FA106B2AA808B595B22BB9DFECF844010CE0C53B10CB24C20AC321
                                                                                                                                                                                                          Function 67000380 Relevance: 5.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1761571661.0000000066F81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 66F80000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761508584.0000000066F80000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761656941.0000000067002000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761673819.0000000067006000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761688481.0000000067007000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761745018.000000006701F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761763263.0000000067022000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761818119.0000000067024000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1761834664.0000000067028000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_66f80000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4020351045-0
                                                                                                                                                                                                          • Opcode ID: 1b0edbb1c638297d1ebdf7b36e5fa0a372ee698b30de6fd8522890611b2a7f38
                                                                                                                                                                                                          • Instruction ID: 9cb60b5e56f25beca080cb13ee2fb0d33e2793e5fee911337a3605564f1e0887
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b0edbb1c638297d1ebdf7b36e5fa0a372ee698b30de6fd8522890611b2a7f38
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0501527273D701C7FA09CF65E99431A23A6F78CB58F909525C92D87311EB79C5A5C320
                                                                                                                                                                                                          Function 00007FF654CA61B0 Relevance: 5.0, APIs: 4, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000001.00000002.1767028691.00007FF654CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF654CA0000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767010599.00007FF654CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767050608.00007FF654CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767067166.00007FF654CBA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767087698.00007FF654CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767104819.00007FF654CD5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767159321.00007FF654CD6000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000001.00000002.1767176235.00007FF654CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_7ff654ca0000_DeltaX.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: free
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1294909896-0
                                                                                                                                                                                                          • Opcode ID: af07cd424250413d133a4ab32c21d85a647da0b60d227f0190338946df3b41f5
                                                                                                                                                                                                          • Instruction ID: 0698d354b4b25a07765c8f99eb973767fad330d26104eb627c8afaab40cd2894
                                                                                                                                                                                                          • Opcode Fuzzy Hash: af07cd424250413d133a4ab32c21d85a647da0b60d227f0190338946df3b41f5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7FF08295F1A51240FD19E662E8B07BC2A345FC1B40F8C85B2CF4EB7682CE2CE4424310