Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PDF_Resave.exe

Overview

General Information

Sample name:PDF_Resave.exe
Analysis ID:1579929
MD5:27cc92c02c64ebc1ffc0b19f361bd5a7
SHA1:a715498ca0fd960b7b71bb6cfa0344569e59ee58
SHA256:9a69ccfd07ee7573b8a7b5ccfa4c58c2f331c854fe3f97e08ed5d29e55824650
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found pyInstaller with non standard icon
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Opens network shares
Potentially malicious time measurement code found
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • PDF_Resave.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\PDF_Resave.exe" MD5: 27CC92C02C64EBC1FFC0B19F361BD5A7)
    • conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • PDF_Resave.exe (PID: 7364 cmdline: "C:\Users\user\Desktop\PDF_Resave.exe" MD5: 27CC92C02C64EBC1FFC0B19F361BD5A7)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Machine Learning detection for sample
Source: PDF_Resave.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE133018A0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,2_2_00007FFE133018A0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE13306124 CRYPTO_memcmp,2_2_00007FFE13306124
Source: PDF_Resave.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: PDF_Resave.exe, 00000002.00000002.1740368131.00007FFE126E9000.00000002.00000001.01000000.00000008.sdmp, _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: PDF_Resave.exe, 00000002.00000002.1740368131.00007FFE126E9000.00000002.00000001.01000000.00000008.sdmp, _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1740718938.00007FFE148E2000.00000002.00000001.01000000.00000009.sdmp, _uuid.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: PDF_Resave.exe, 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmp, pyexpat.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PDF_Resave.exe, 00000000.00000003.1664218485.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: PDF_Resave.exe, 00000000.00000003.1664218485.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: PDF_Resave.exe, 00000002.00000002.1738096620.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B69F0 FindFirstFileExW,FindClose,0_2_00007FF7BD3B69F0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3B69F0 FindFirstFileExW,FindClose,2_2_00007FF7BD3B69F0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A322E _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,2_2_00007FFDFB1A322E
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEAC7000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _hashlib.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEAC7000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.cov
Source: PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.v
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEAC7000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _hashlib.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _lzma.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _hashlib.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _hashlib.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEAC7000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEAC7000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: PDF_Resave.exe, 00000002.00000003.1691962181.000002D46C566000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1735349659.000002D46E430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1666313943.00000206EEAC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1668195575.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _hashlib.pyd.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: PDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: PDF_Resave.exe, 00000002.00000002.1735349659.000002D46E4EC000.00000004.00001000.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1734614811.000002D46C590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.java2s.com/Open-Source/Java-Document/PDF/PDF-Renderer/com/sun/pdfview/decode/LZWDecode.ja
Source: PDF_Resave.exe, 00000002.00000003.1691962181.000002D46C566000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1735530935.000002D46E53C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: PDF_Resave.exe, 00000002.00000003.1691986331.000002D46C548000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BCC0000.00000004.00001000.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691756192.000002D46C548000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693243429.000002D46C548000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rasip.fer.hr/research/compress/algorithms/fund/lz/lzw.html
Source: base_library.zip.0.drString found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: PDF_Resave.exe, 00000002.00000003.1693929478.000002D46C267000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1732931173.000002D46C276000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691411109.000002D46C267000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1677357460.000002D46C4E8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1680277323.000002D46C286000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729744351.000002D46C275000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1677537529.000002D46C4E8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1726292405.000002D46C271000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1719025275.000002D46C267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42195.
Source: PDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: PDF_Resave.exe, 00000002.00000002.1735530935.000002D46E550000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/py-pdf/PyPDF2/blob/main/LICENSE
Source: PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BD48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: PDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: PDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: PDF_Resave.exe, 00000002.00000002.1734718419.000002D46DE30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ia802202.us.archive.org/8/items/pdfy-0vt8s-egqFwDl7L2/PDF%20Reference%201.0.pdf
Source: base_library.zip.0.drString found in binary or memory: https://mahler:8092/site-updates.py
Source: PDF_Resave.exe, 00000002.00000002.1734614811.000002D46C590000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
Source: PDF_Resave.exe, 00000002.00000002.1738096620.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
Source: PDF_Resave.exe, 00000002.00000002.1732960209.000002D46C290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypdf2.readthedocs.io/.
Source: PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.drString found in binary or memory: https://www.openssl.org/H
Source: base_library.zip.0.drString found in binary or memory: https://www.python.org/
Source: PDF_Resave.exe, 00000002.00000003.1672897369.000002D46C19E000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BCC0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: PDF_Resave.exe, 00000002.00000002.1738486039.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://www.python.org/psf/license/

System Summary

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sampleStatic PE information: Filename: PDF_Resave.exe
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D4EB00_2_00007FF7BD3D4EB0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D5DFC0_2_00007FF7BD3D5DFC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C68880_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B58E00_2_00007FF7BD3B58E0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3CFA980_2_00007FF7BD3CFA98
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C26240_2_00007FF7BD3C2624
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C16D40_2_00007FF7BD3C16D4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C66D40_2_00007FF7BD3C66D4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3CCD740_2_00007FF7BD3CCD74
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C05700_2_00007FF7BD3C0570
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BFD500_2_00007FF7BD3BFD50
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3CFA980_2_00007FF7BD3CFA98
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D2DC00_2_00007FF7BD3D2DC0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3CD8880_2_00007FF7BD3CD888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C710C0_2_00007FF7BD3C710C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D58B00_2_00007FF7BD3D58B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C07740_2_00007FF7BD3C0774
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BFF540_2_00007FF7BD3BFF54
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C4FD00_2_00007FF7BD3C4FD0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D325C0_2_00007FF7BD3D325C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C2A280_2_00007FF7BD3C2A28
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D0A440_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C01600_2_00007FF7BD3C0160
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D512C0_2_00007FF7BD3D512C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C21EC0_2_00007FF7BD3C21EC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3CD2080_2_00007FF7BD3CD208
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C68880_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B74300_2_00007FF7BD3B7430
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C8D100_2_00007FF7BD3C8D10
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C03640_2_00007FF7BD3C0364
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C133C0_2_00007FF7BD3C133C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D8BF80_2_00007FF7BD3D8BF8
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D5DFC2_2_00007FF7BD3D5DFC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C21EC2_2_00007FF7BD3C21EC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C133C2_2_00007FF7BD3C133C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C26242_2_00007FF7BD3C2624
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D4EB02_2_00007FF7BD3D4EB0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C16D42_2_00007FF7BD3C16D4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C66D42_2_00007FF7BD3C66D4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3CCD742_2_00007FF7BD3CCD74
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C05702_2_00007FF7BD3C0570
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3BFD502_2_00007FF7BD3BFD50
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3CFA982_2_00007FF7BD3CFA98
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D2DC02_2_00007FF7BD3D2DC0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C68882_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3CD8882_2_00007FF7BD3CD888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3B58E02_2_00007FF7BD3B58E0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C710C2_2_00007FF7BD3C710C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D58B02_2_00007FF7BD3D58B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C07742_2_00007FF7BD3C0774
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3BFF542_2_00007FF7BD3BFF54
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C4FD02_2_00007FF7BD3C4FD0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D325C2_2_00007FF7BD3D325C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C2A282_2_00007FF7BD3C2A28
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D0A442_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3CFA982_2_00007FF7BD3CFA98
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C01602_2_00007FF7BD3C0160
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D512C2_2_00007FF7BD3D512C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3CD2082_2_00007FF7BD3CD208
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C68882_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3B74302_2_00007FF7BD3B7430
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C8D102_2_00007FF7BD3C8D10
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C03642_2_00007FF7BD3C0364
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D8BF82_2_00007FF7BD3D8BF8
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A655F2_2_00007FFDFB1A655F
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A3FDF2_2_00007FFDFB1A3FDF
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6A872_2_00007FFDFB1A6A87
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB3DFA702_2_00007FFDFB3DFA70
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6F282_2_00007FFDFB1A6F28
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A21B72_2_00007FFDFB1A21B7
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A60A02_2_00007FFDFB1A60A0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A22E82_2_00007FFDFB1A22E8
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A416A2_2_00007FFDFB1A416A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A704A2_2_00007FFDFB1A704A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A22892_2_00007FFDFB1A2289
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BBF202_2_00007FFDFB1BBF20
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BBD602_2_00007FFDFB1BBD60
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A30C62_2_00007FFDFB1A30C6
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB343C902_2_00007FFDFB343C90
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D7D102_2_00007FFDFB2D7D10
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB357CF02_2_00007FFDFB357CF0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A29D22_2_00007FFDFB1A29D2
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6EF12_2_00007FFDFB1A6EF1
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A114F2_2_00007FFDFB1A114F
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1CB1C02_2_00007FFDFB1CB1C0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A46382_2_00007FFDFB1A4638
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BF2002_2_00007FFDFB1BF200
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2DB2402_2_00007FFDFB2DB240
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BF0602_2_00007FFDFB1BF060
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A213F2_2_00007FFDFB1A213F
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1EA12_2_00007FFDFB1A1EA1
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB20F7002_2_00007FFDFB20F700
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A516E2_2_00007FFDFB1A516E
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A3B982_2_00007FFDFB1A3B98
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6CBC2_2_00007FFDFB1A6CBC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5D8A2_2_00007FFDFB1A5D8A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1CB5502_2_00007FFDFB1CB550
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D75402_2_00007FFDFB2D7540
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1B222_2_00007FFDFB1A1B22
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A60DC2_2_00007FFDFB1A60DC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4D092_2_00007FFDFB1A4D09
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5DA32_2_00007FFDFB1A5DA3
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5E252_2_00007FFDFB1A5E25
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5A652_2_00007FFDFB1A5A65
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4E532_2_00007FFDFB1A4E53
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D28A02_2_00007FFDFB2D28A0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB32E9202_2_00007FFDFB32E920
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A23F12_2_00007FFDFB1A23F1
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1CC12_2_00007FFDFB1A1CC1
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A72C52_2_00007FFDFB1A72C5
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5B142_2_00007FFDFB1A5B14
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BEF002_2_00007FFDFB1BEF00
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB282C902_2_00007FFDFB282C90
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB342D502_2_00007FFDFB342D50
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D63602_2_00007FFDFB2D6360
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A57D62_2_00007FFDFB1A57D6
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1A4B2_2_00007FFDFB1A1A4B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A435E2_2_00007FFDFB1A435E
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A37922_2_00007FFDFB1A3792
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A474B2_2_00007FFDFB1A474B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1B312_2_00007FFDFB1A1B31
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D60602_2_00007FFDFB2D6060
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2D102_2_00007FFDFB1A2D10
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6FFF2_2_00007FFDFB1A6FFF
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A707C2_2_00007FFDFB1A707C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A348B2_2_00007FFDFB1A348B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A36982_2_00007FFDFB1A3698
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1CFD2_2_00007FFDFB1A1CFD
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB341BF02_2_00007FFDFB341BF0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A36022_2_00007FFDFB1A3602
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A53C62_2_00007FFDFB1A53C6
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A216C2_2_00007FFDFB1A216C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4F432_2_00007FFDFB1A4F43
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A59FC2_2_00007FFDFB1A59FC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A3A8A2_2_00007FFDFB1A3A8A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A21352_2_00007FFDFB1A2135
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A12992_2_00007FFDFB1A1299
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A54CF2_2_00007FFDFB1A54CF
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A15C82_2_00007FFDFB1A15C8
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A65642_2_00007FFDFB1A6564
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A54342_2_00007FFDFB1A5434
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A3BA72_2_00007FFDFB1A3BA7
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A26712_2_00007FFDFB1A2671
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A72572_2_00007FFDFB1A7257
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A29872_2_00007FFDFB1A2987
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1D832_2_00007FFDFB1A1D83
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A736A2_2_00007FFDFB1A736A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A72AC2_2_00007FFDFB1A72AC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A38372_2_00007FFDFB1A3837
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB359CD02_2_00007FFDFB359CD0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A638E2_2_00007FFDFB1A638E
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A16222_2_00007FFDFB1A1622
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A50B02_2_00007FFDFB1A50B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A55152_2_00007FFDFB1A5515
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A68CA2_2_00007FFDFB1A68CA
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BD2602_2_00007FFDFB1BD260
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A318E2_2_00007FFDFB1A318E
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2CD1D02_2_00007FFDFB2CD1D0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2E11B02_2_00007FFDFB2E11B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5BF52_2_00007FFDFB1A5BF5
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1C52002_2_00007FFDFB1C5200
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A144C2_2_00007FFDFB1A144C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A12172_2_00007FFDFB1A1217
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A65A02_2_00007FFDFB1A65A0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A44082_2_00007FFDFB1A4408
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A710D2_2_00007FFDFB1A710D
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A10AA2_2_00007FFDFB1A10AA
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A3A942_2_00007FFDFB1A3A94
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2E17E02_2_00007FFDFB2E17E0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A54D42_2_00007FFDFB1A54D4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5F102_2_00007FFDFB1A5F10
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A504C2_2_00007FFDFB1A504C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4ACA2_2_00007FFDFB1A4ACA
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A44CB2_2_00007FFDFB1A44CB
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A56142_2_00007FFDFB1A5614
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A428C2_2_00007FFDFB1A428C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A53AD2_2_00007FFDFB1A53AD
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB3594F02_2_00007FFDFB3594F0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A27612_2_00007FFDFB1A2761
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A59342_2_00007FFDFB1A5934
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A11CC2_2_00007FFDFB1A11CC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2FD12_2_00007FFDFB1A2FD1
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4C192_2_00007FFDFB1A4C19
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A22AC2_2_00007FFDFB1A22AC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4A592_2_00007FFDFB1A4A59
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2D792_2_00007FFDFB1A2D79
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6EBF2_2_00007FFDFB1A6EBF
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A36342_2_00007FFDFB1A3634
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A22FC2_2_00007FFDFB1A22FC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A1F962_2_00007FFDFB1A1F96
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A26EE2_2_00007FFDFB1A26EE
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6D5C2_2_00007FFDFB1A6D5C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A11402_2_00007FFDFB1A1140
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB354CF02_2_00007FFDFB354CF0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A14242_2_00007FFDFB1A1424
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2504402_2_00007FFDFB250440
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4C3C2_2_00007FFDFB1A4C3C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2C7A2_2_00007FFDFB1A2C7A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2E912_2_00007FFDFB1A2E91
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2E03402_2_00007FFDFB2E0340
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A276B2_2_00007FFDFB1A276B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2D00702_2_00007FFDFB2D0070
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A41062_2_00007FFDFB1A4106
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A32EC2_2_00007FFDFB1A32EC
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5B782_2_00007FFDFB1A5B78
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A6C212_2_00007FFDFB1A6C21
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A4B5B2_2_00007FFDFB1A4B5B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB2CC8302_2_00007FFDFB2CC830
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A25F42_2_00007FFDFB1A25F4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB3585C02_2_00007FFDFB3585C0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A177B2_2_00007FFDFB1A177B
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BC6202_2_00007FFDFB1BC620
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1BC4802_2_00007FFDFB1BC480
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A69E72_2_00007FFDFB1A69E7
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE11EB7BD02_2_00007FFE11EB7BD0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE11EB7F7A2_2_00007FFE11EB7F7A
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126C96902_2_00007FFE126C9690
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126D32702_2_00007FFE126D3270
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126C32D02_2_00007FFE126C32D0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126D40B42_2_00007FFE126D40B4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126CD8B02_2_00007FFE126CD8B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126CFC942_2_00007FFE126CFC94
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126C8C702_2_00007FFE126C8C70
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126CA8C02_2_00007FFE126CA8C0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126C71E92_2_00007FFE126C71E9
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126CA5E02_2_00007FFE126CA5E0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126CC5D02_2_00007FFE126CC5D0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE133018A02_2_00007FFE133018A0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE1A4577782_2_00007FFE1A457778
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE1A4596202_2_00007FFE1A459620
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A24B9 appears 83 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A4840 appears 130 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FF7BD3B1CB0 appears 38 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A1EF1 appears 1585 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A2739 appears 512 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A3012 appears 55 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FF7BD3B1C50 appears 90 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A4D6D appears 35 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A688E appears 31 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A698D appears 51 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A2A09 appears 172 times
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: String function: 00007FFDFB1A405C appears 783 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: PDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1664218485.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1667462301.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exeBinary or memory string: OriginalFilename vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1740469746.00007FFE126FA000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1740797470.00007FFE148E4000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs PDF_Resave.exe
Source: PDF_Resave.exe, 00000002.00000002.1740058870.00007FFDFBAB7000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs PDF_Resave.exe
Source: classification engineClassification label: mal60.spyw.evad.winEXE@4/16@0/0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B6680 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF7BD3B6680
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042Jump to behavior
Source: PDF_Resave.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PDF_Resave.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeFile read: C:\Users\user\Desktop\PDF_Resave.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\PDF_Resave.exe "C:\Users\user\Desktop\PDF_Resave.exe"
Source: C:\Users\user\Desktop\PDF_Resave.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PDF_Resave.exeProcess created: C:\Users\user\Desktop\PDF_Resave.exe "C:\Users\user\Desktop\PDF_Resave.exe"
Source: C:\Users\user\Desktop\PDF_Resave.exeProcess created: C:\Users\user\Desktop\PDF_Resave.exe "C:\Users\user\Desktop\PDF_Resave.exe"Jump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: python3.dllJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: libcrypto-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeSection loaded: kernel.appcore.dllJump to behavior
Source: PDF_Resave.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: PDF_Resave.exeStatic file information: File size 7729425 > 1048576
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PDF_Resave.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: PDF_Resave.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: PDF_Resave.exe, 00000000.00000003.1670037811.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: PDF_Resave.exe, 00000000.00000003.1670226310.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: PDF_Resave.exe, 00000000.00000003.1664811591.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: PDF_Resave.exe, 00000002.00000002.1740368131.00007FFE126E9000.00000002.00000001.01000000.00000008.sdmp, _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: PDF_Resave.exe, 00000002.00000002.1740368131.00007FFE126E9000.00000002.00000001.01000000.00000008.sdmp, _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: PDF_Resave.exe, 00000000.00000003.1665818401.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1740718938.00007FFE148E2000.00000002.00000001.01000000.00000009.sdmp, _uuid.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: PDF_Resave.exe, 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmp, pyexpat.pyd.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: PDF_Resave.exe, 00000000.00000003.1664406065.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PDF_Resave.exe, 00000000.00000003.1664218485.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: PDF_Resave.exe, 00000000.00000003.1664218485.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: PDF_Resave.exe, 00000000.00000003.1665110877.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: PDF_Resave.exe, 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmp, libcrypto-1_1.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: PDF_Resave.exe, 00000002.00000002.1738096620.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source: PDF_Resave.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PDF_Resave.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PDF_Resave.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PDF_Resave.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PDF_Resave.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: PDF_Resave.exeStatic PE information: section name: _RDATA
Source: python311.dll.0.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\PDF_Resave.exeProcess created: "C:\Users\user\Desktop\PDF_Resave.exe"
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\select.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73042\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B50B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7BD3B50B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5731 rdtsc 2_2_00007FFDFB1A5731
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\select.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73042\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\PDF_Resave.exeAPI coverage: 1.6 %
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3B69F0 FindFirstFileExW,FindClose,0_2_00007FF7BD3B69F0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3D0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF7BD3D0A44
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3B69F0 FindFirstFileExW,FindClose,2_2_00007FF7BD3B69F0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C6888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF7BD3C6888
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A322E _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,2_2_00007FFDFB1A322E

Anti Debugging

barindex
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A57312_2_00007FFDFB1A5731
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A42462_2_00007FFDFB1A4246
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5731 rdtsc 2_2_00007FFDFB1A5731
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BAA3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7BD3BAA3C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D2630 GetProcessHeap,0_2_00007FF7BD3D2630
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BAA3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7BD3BAA3C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BA190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7BD3BA190
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3C9C54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7BD3C9C54
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BABE4 SetUnhandledExceptionFilter,0_2_00007FF7BD3BABE4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3BAA3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF7BD3BAA3C
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3BA190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF7BD3BA190
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3C9C54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF7BD3C9C54
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FF7BD3BABE4 SetUnhandledExceptionFilter,2_2_00007FF7BD3BABE4
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A5A24 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFDFB1A5A24
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE11EC0238 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE11EC0238
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE11EBFC70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE11EBFC70
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126E00B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE126E00B0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE126E09D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE126E09D8
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE13304570 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE13304570
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE13303FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE13303FA0
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE148E1460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE148E1460
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE148E1A30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE148E1A30
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFE1A460468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE1A460468
Source: C:\Users\user\Desktop\PDF_Resave.exeProcess created: C:\Users\user\Desktop\PDF_Resave.exe "C:\Users\user\Desktop\PDF_Resave.exe"Jump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D8A40 cpuid 0_2_00007FF7BD3D8A40
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\_decimal.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\_uuid.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73042\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeQueries volume information: C:\Users\user\Desktop\PDF_Resave.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3BA920 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7BD3BA920
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 0_2_00007FF7BD3D4EB0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7BD3D4EB0

Stealing of Sensitive Information

barindex
Opens network shares
Source: C:\Users\user\Desktop\PDF_Resave.exeFile opened: \\kmcluster\UNIDATA\PDF_PROCESS\PDF\Jump to behavior
Source: C:\Users\user\Desktop\PDF_Resave.exeCode function: 2_2_00007FFDFB1A2B62 bind,WSAGetLastError,2_2_00007FFDFB1A2B62

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping1
Network Share Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory2
System Time Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager3
Security Software Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets22
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
PDF_Resave.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI73042\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\_uuid.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\libcrypto-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\libssl-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\pyexpat.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\python311.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73042\unicodedata.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://bugs.python.org/issue42195.0%Avira URL Cloudsafe
https://ia802202.us.archive.org/8/items/pdfy-0vt8s-egqFwDl7L2/PDF%20Reference%201.0.pdf0%Avira URL Cloudsafe
http://www.rasip.fer.hr/research/compress/algorithms/fund/lz/lzw.html0%Avira URL Cloudsafe
https://pypdf2.readthedocs.io/.0%Avira URL Cloudsafe
http://cacerts.v0%Avira URL Cloudsafe
http://www.robotstxt.org/norobots-rfc.txt0%Avira URL Cloudsafe
http://cacerts.digicert.cov0%Avira URL Cloudsafe
http://www.java2s.com/Open-Source/Java-Document/PDF/PDF-Renderer/com/sun/pdfview/decode/LZWDecode.ja0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.rasip.fer.hr/research/compress/algorithms/fund/lz/lzw.htmlPDF_Resave.exe, 00000002.00000003.1691986331.000002D46C548000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BCC0000.00000004.00001000.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691756192.000002D46C548000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693243429.000002D46C548000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BD48000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://pypdf2.readthedocs.io/.PDF_Resave.exe, 00000002.00000002.1732960209.000002D46C290000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://mahler:8092/site-updates.pybase_library.zip.0.drfalse
      		high
      http://www.robotstxt.org/norobots-rfc.txtbase_library.zip.0.drfalse
      • Avira URL Cloud: safe
      		unknown
      http://cacerts.vPDF_Resave.exe, 00000000.00000003.1665273791.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/py-pdf/PyPDF2/blob/main/LICENSEPDF_Resave.exe, 00000002.00000002.1735530935.000002D46E550000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://www.python.org/download/releases/2.3/mro/.PDF_Resave.exe, 00000002.00000003.1672897369.000002D46C19E000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731895122.000002D46BCC0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
          		high
          https://www.python.org/base_library.zip.0.drfalse
            		high
            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerPDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://ia802202.us.archive.org/8/items/pdfy-0vt8s-egqFwDl7L2/PDF%20Reference%201.0.pdfPDF_Resave.exe, 00000002.00000002.1734718419.000002D46DE30000.00000004.00001000.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlPDF_Resave.exe, 00000002.00000003.1691962181.000002D46C566000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1735349659.000002D46E430000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#PDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syPDF_Resave.exe, 00000002.00000003.1725857960.000002D46BBC2000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1724142196.000002D46BBBF000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1728051374.000002D46BB82000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1727241486.000002D46BBC3000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731540792.000002D46BBC8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729399098.000002D46BBC5000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://www.python.org/psf/license/PDF_Resave.exe, 00000002.00000002.1738486039.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                      		high
                      https://bugs.python.org/issue42195.PDF_Resave.exe, 00000002.00000003.1693929478.000002D46C267000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1732931173.000002D46C276000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691411109.000002D46C267000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1677357460.000002D46C4E8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1680277323.000002D46C286000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1729744351.000002D46C275000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1677537529.000002D46C4E8000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1726292405.000002D46C271000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1719025275.000002D46C267000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://cacerts.digicert.covPDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://cacerts.digicert.coPDF_Resave.exe, 00000000.00000003.1664606579.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000000.00000003.1664962259.00000206EEABA000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://www.java2s.com/Open-Source/Java-Document/PDF/PDF-Renderer/com/sun/pdfview/decode/LZWDecode.jaPDF_Resave.exe, 00000002.00000002.1735349659.000002D46E4EC000.00000004.00001000.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1734614811.000002D46C590000.00000004.00001000.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.openssl.org/HPDF_Resave.exe, 00000000.00000003.1667162210.00000206EEABA000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.drfalse
                          		high
                          http://www.iana.org/time-zones/repository/tz-link.htmlPDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://peps.python.org/pep-0205/PDF_Resave.exe, 00000002.00000002.1734614811.000002D46C590000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                              		high
                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyPDF_Resave.exe, 00000002.00000002.1731240658.000002D46BB83000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmPDF_Resave.exe, 00000002.00000003.1691962181.000002D46C566000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1693113629.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000003.1691907930.000002D46E004000.00000004.00000020.00020000.00000000.sdmp, PDF_Resave.exe, 00000002.00000002.1735530935.000002D46E53C000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://peps.python.org/pep-0263/PDF_Resave.exe, 00000002.00000002.1738096620.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                                    		high

                                    World Map of Contacted IPs

                                    ⊘No contacted IP infos

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1579929
                                    Start date and time:2024-12-23 15:43:33 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 5m 32s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:3
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:PDF_Resave.exe
                                    Detection:MAL
                                    Classification:mal60.spyw.evad.winEXE@4/16@0/0
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HCA Information:Failed
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe
                                    • Stop behavior analysis, all processes terminated

                                    Warnings

                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                    • VT rate limit hit for: PDF_Resave.exe

                                    Simulations

                                    Behavior and APIs

                                    ⊘No simulations

                                    Joe Sandbox View / Context

                                    IPs

                                    ⊘No context

                                    Domains

                                    ⊘No context

                                    ASNs

                                    ⊘No context

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\user\AppData\Local\Temp\_MEI73042\VCRUNTIME140.dllphost.exeGet hashmaliciousBlank GrabberBrowse
                                      shost.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                        sppawx.exeGet hashmaliciousBlank GrabberBrowse
                                          qhos.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                            wsapx.exeGet hashmaliciousBlank GrabberBrowse
                                              lz4wnSavmK.exeGet hashmaliciousPython StealerBrowse
                                                WVuXCNNYG0.exeGet hashmaliciousPython StealerBrowse
                                                  dipwo1iToJ.exeGet hashmaliciousPython StealerBrowse
                                                    Counseling_Services_Overview.docmGet hashmaliciousUnknownBrowse
                                                      uOsIQqfgiT.exeGet hashmaliciousCharity, TrojanRansomBrowse
                                                        C:\Users\user\AppData\Local\Temp\_MEI73042\_bz2.pydCounseling_Services_Overview.docmGet hashmaliciousUnknownBrowse
                                                          uOsIQqfgiT.exeGet hashmaliciousCharity, TrojanRansomBrowse
                                                            RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                              file.exeGet hashmaliciousCStealerBrowse
                                                                SecuriteInfo.com.W32.Agent.NS.tr.pws.15623.10495.exeGet hashmaliciousUnknownBrowse
                                                                  4.7.exeGet hashmaliciousUnknownBrowse
                                                                    LisectAVT_2403002A_441.exeGet hashmaliciousUnknownBrowse
                                                                      SecuriteInfo.com.Win64.Evo-gen.23205.20359.exeGet hashmaliciousUnknownBrowse
                                                                        mav17final.exeGet hashmaliciousXmrigBrowse
                                                                          file.exeGet hashmaliciousUnknownBrowse

                                                                            Created / dropped Files

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\VCRUNTIME140.dll

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):109392
                                                                            Entropy (8bit):6.641929675972235
                                                                            Encrypted:false
                                                                            SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                            MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                            SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                            SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                            SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Joe Sandbox View:
                                                                            • Filename: phost.exe, Detection: malicious, Browse
                                                                            • Filename: shost.exe, Detection: malicious, Browse
                                                                            • Filename: sppawx.exe, Detection: malicious, Browse
                                                                            • Filename: qhos.exe, Detection: malicious, Browse
                                                                            • Filename: wsapx.exe, Detection: malicious, Browse
                                                                            • Filename: lz4wnSavmK.exe, Detection: malicious, Browse
                                                                            • Filename: WVuXCNNYG0.exe, Detection: malicious, Browse
                                                                            • Filename: dipwo1iToJ.exe, Detection: malicious, Browse
                                                                            • Filename: Counseling_Services_Overview.docm, Detection: malicious, Browse
                                                                            • Filename: uOsIQqfgiT.exe, Detection: malicious, Browse
                                                                            Reputation:moderate, very likely benign file
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_bz2.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):84760
                                                                            Entropy (8bit):6.570831353064175
                                                                            Encrypted:false
                                                                            SSDEEP:1536:PdQz7pZ3catNZTRGE51LOBK5bib8tsfYqpIPCV17SyQPx:VQz9Z5VOwiItsAqpIPCV1Gx
                                                                            MD5:3859239CED9A45399B967EBCE5A6BA23
                                                                            SHA1:6F8FF3DF90AC833C1EB69208DB462CDA8CA3F8D6
                                                                            SHA-256:A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
                                                                            SHA-512:030E5CE81E36BD55F69D55CBB8385820EB7C1F95342C1A32058F49ABEABB485B1C4A30877C07A56C9D909228E45A4196872E14DED4F87ADAA8B6AD97463E5C69
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Joe Sandbox View:
                                                                            • Filename: Counseling_Services_Overview.docm, Detection: malicious, Browse
                                                                            • Filename: uOsIQqfgiT.exe, Detection: malicious, Browse
                                                                            • Filename: RuntimeusererVers.exe, Detection: malicious, Browse
                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                            • Filename: SecuriteInfo.com.W32.Agent.NS.tr.pws.15623.10495.exe, Detection: malicious, Browse
                                                                            • Filename: 4.7.exe, Detection: malicious, Browse
                                                                            • Filename: LisectAVT_2403002A_441.exe, Detection: malicious, Browse
                                                                            • Filename: SecuriteInfo.com.Win64.Evo-gen.23205.20359.exe, Detection: malicious, Browse
                                                                            • Filename: mav17final.exe, Detection: malicious, Browse
                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                            Reputation:moderate, very likely benign file
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A}...............d`.....J`......J`......J`......J`......J`.......`......Nd..........Z....`.......`.......`.......`......Rich............PE..d......d.........." ...".....^......L........................................P.......`....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_decimal.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):253200
                                                                            Entropy (8bit):6.559097478184273
                                                                            Encrypted:false
                                                                            SSDEEP:6144:7t9gXW32tb0yf6CgLp+E4YECs5wxvj9qWM53pLW1Apw9tBg2YAp:7ngXW3wgyCiE4texvGI4Ap
                                                                            MD5:65B4AB77D6C6231C145D3E20E7073F51
                                                                            SHA1:23D5CE68ED6AA8EAABE3366D2DD04E89D248328E
                                                                            SHA-256:93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614
                                                                            SHA-512:28023446E5AC90E9E618673C879CA46F598A62FBB9E69EF925DB334AD9CB1544916CAF81E2ECDC26B75964DCEDBA4AD4DE1BA2C42FB838D0DF504D963FCF17EE
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Reputation:moderate, very likely benign file
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nyR.............w.......s.......s.......s.......s.......s.......w.........._....s.......s.......s.......s.......s......Rich............PE..d......d.........." ...".v...<......L...............................................Rn....`..........................................T..P...`T...................&......./......P.......T...........................P...@............................................text....u.......v.................. ..`.rdata..<............z..............@..@.data....*...p...$...R..............@....pdata...&.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_hashlib.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):65304
                                                                            Entropy (8bit):6.222786912280051
                                                                            Encrypted:false
                                                                            SSDEEP:1536:6TO+CPN/pV8ETeERZX/fchw/IpBIPOIVQ7SygPx:mClZZow/IpBIPOIVQyx
                                                                            MD5:4255C44DC64F11F32C961BF275AAB3A2
                                                                            SHA1:C1631B2821A7E8A1783ECFE9A14DB453BE54C30A
                                                                            SHA-256:E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
                                                                            SHA-512:7D3A306755A123B246F31994CD812E7922943CDBBC9DB5A6E4D3372EA434A635FFD3945B5D2046DE669E7983EF2845BD007A441D09CFE05CF346523C12BDAD52
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Reputation:moderate, very likely benign file
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.u.'.&.'.&.'.&._,&.'.&.[.'.'.&.[.'.'.&.[.'.'.&.[.'.'.&._.'.'.&*[.'.'.&.'.&e'.&*[.'.'.&*[.'.'.&*[@&.'.&*[.'.'.&Rich.'.&........PE..d......d.........." ...".T...~......`?...............................................%....`.............................................P.......................,......../......\...0}..T............................{..@............p..(............................text...uR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_lzma.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):158992
                                                                            Entropy (8bit):6.8491146526380025
                                                                            Encrypted:false
                                                                            SSDEEP:3072:A4lirS97HrdVmEkGCm5hAznf49mNo2NOvJ02pIPZ1wBExN:VlirG0EkTVAYO2NQ3w
                                                                            MD5:E5ABC3A72996F8FDE0BCF709E6577D9D
                                                                            SHA1:15770BDCD06E171F0B868C803B8CF33A8581EDD3
                                                                            SHA-256:1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
                                                                            SHA-512:B347474DC071F2857E1E16965B43DB6518E35915B8168BDEFF1EAD4DFF710A1CC9F04CA0CED23A6DE40D717EEA375EEDB0BF3714DAF35DE6A77F071DB33DFAE6
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D,..D,..D,...,..D,..E-..D,..A-..D,..@-..D,..G-..D,M.E-..D,..E-..D,..E,.D,M.I-..D,M.D-..D,M.,..D,M.F-..D,Rich..D,........PE..d...$..d.........." ...".b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B................................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_socket.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):79640
                                                                            Entropy (8bit):6.290841920161528
                                                                            Encrypted:false
                                                                            SSDEEP:1536:0JltpedXL+3ujz9/s+S+pzpMoiyivViaE9IPLwj7SyZPx:07tp4i3ujz9/sT+pzqoavVpE9IPLwjHx
                                                                            MD5:1EEA9568D6FDEF29B9963783827F5867
                                                                            SHA1:A17760365094966220661AD87E57EFE09CD85B84
                                                                            SHA-256:74181072392A3727049EA3681FE9E59516373809CED53E08F6DA7C496B76E117
                                                                            SHA-512:D9443B70FCDC4D0EA1CB93A88325012D3F99DB88C36393A7DED6D04F590E582F7F1640D8B153FE3C5342FA93802A8374F03F6CD37DD40CDBB5ADE2E07FAD1E09
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RXY..97..97..97..A...97.YE6..97.YE2..97.YE3..97.YE4..97..E6..97..96..97.]A6..97..E:..97..E7..97..E...97..E5..97.Rich.97.................PE..d... ..d.........." ...".l...........%.......................................P......V.....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...:k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_ssl.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):161040
                                                                            Entropy (8bit):6.029728458381984
                                                                            Encrypted:false
                                                                            SSDEEP:3072:LMaGbIQQbN9W3PiNGeA66l8rBk3xA87xfCA+nbUtFMsVjTNbEzc+pIPC7ODxd:LMaG0bN96oG1l8YA8ZMSR+E
                                                                            MD5:208B0108172E59542260934A2E7CFA85
                                                                            SHA1:1D7FFB1B1754B97448EB41E686C0C79194D2AB3A
                                                                            SHA-256:5160500474EC95D4F3AF7E467CC70CB37BEC1D12545F0299AAB6D69CEA106C69
                                                                            SHA-512:41ABF6DEAB0F6C048967CA6060C337067F9F8125529925971BE86681EC0D3592C72B9CC85DD8BDEE5DD3E4E69E3BB629710D2D641078D5618B4F55B8A60CC69D
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........p...p...p....8..p.......p.......p.......p.......p..N....p...p...q.......p..N....p..N....p..N.T..p..N....p..Rich.p..........................PE..d...'..d.........." ..."............l+..............................................NS....`.............................................d...t........`.......P.......F.../...p..8...0...T...............................@............................................text............................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P......."..............@..@.rsrc........`......................@..@.reloc..8....p.......8..............@..B................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\_uuid.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):25360
                                                                            Entropy (8bit):6.6307231018245325
                                                                            Encrypted:false
                                                                            SSDEEP:384:SR9ZfwFpEWE6ivQpIPZwGjHQIYiSy1pCQKzmPxh8E9VF0NyptVQcM:SRvqpEM4QpIPZw65YiSyvamPxWE3PS
                                                                            MD5:46E9D7B5D9668C9DB5CAA48782CA71BA
                                                                            SHA1:6BBC83A542053991B57F431DD377940418848131
                                                                            SHA-256:F6063622C0A0A34468679413D1B18D1F3BE67E747696AB972361FAED4B8D6735
                                                                            SHA-512:C5B171EBDB51B1755281C3180B30E88796DB8AA96073489613DAB96B6959A205846711187266A0BA30782102CE14FBFA4D9F413A2C018494597600482329EBF7
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h%p..K#..K#..K#.q.#..K#.uJ"..K#.uN"..K#.uO"..K#.uH"..K#.uJ"..K#.qJ"..K#..J#..K#.uC"..K#.uK"..K#.u.#..K#.uI"..K#Rich..K#................PE..d......d.........." ...".....&...... ........................................p.......p....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\base_library.zip

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                            Category:dropped
                                                                            Size (bytes):1847603
                                                                            Entropy (8bit):5.576587358103163
                                                                            Encrypted:false
                                                                            SSDEEP:24576:mQR5pATu7xm4lUKdcubgAnyfbazZ0iwh9EpdYf9P3sLoThUdWQhuHHa:mQR5plxm+zJ5uUwQ5
                                                                            MD5:E17CE7183E682DE459EEC1A5AC9CBBFF
                                                                            SHA1:722968CA6EB123730EBC30FF2D498F9A5DAD4CC1
                                                                            SHA-256:FF6A37C49EE4BB07A763866D4163126165038296C1FB7B730928297C25CFBE6D
                                                                            SHA-512:FAB76B59DCD3570695FA260F56E277F8D714048F3D89F6E9F69EA700FCA7C097D0DB5F5294BEAB4E6409570408F1D680E8220851FEDEDB981ACB129A415358D1
                                                                            Malicious:false
                                                                            Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\libcrypto-1_1.dll

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):3445016
                                                                            Entropy (8bit):6.099467326309974
                                                                            Encrypted:false
                                                                            SSDEEP:98304:+/+YgEQaGDoWS04ki7x+QRsZ51CPwDv3uFfJx:MLgEXGUZ37x+VZ51CPwDv3uFfJx
                                                                            MD5:E94733523BCD9A1FB6AC47E10A267287
                                                                            SHA1:94033B405386D04C75FFE6A424B9814B75C608AC
                                                                            SHA-256:F20EB4EFD8647B5273FDAAFCEB8CCB2B8BA5329665878E01986CBFC1E6832C44
                                                                            SHA-512:07DD0EB86498497E693DA0F9DD08DE5B7B09052A2D6754CFBC2AA260E7F56790E6C0A968875F7803CB735609B1E9B9C91A91B84913059C561BFFED5AB2CBB29F
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).h.z.h.z.h.z..Oz.h.z...{.h.z...{.h.z...{.h.z...{.h.z.h.zjh.z...{.h.z=..{.h.z=..{.j.z=..{.h.z=.#z.h.z=..{.h.zRich.h.z........................PE..d.....wd.........." ..."..$...................................................5......o5...`..........................................y/..h...J4.@.....4.|....p2......b4../....4..O..P.,.8.............................,.@............@4..............................text...$.$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata..h....p2.......1.............@..@.idata..^#...@4..$....3.............@..@.00cfg..u....p4.......3.............@..@.rsrc...|.....4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\libssl-1_1.dll

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):704792
                                                                            Entropy (8bit):5.55753143710539
                                                                            Encrypted:false
                                                                            SSDEEP:12288:ihO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0T9qwfU2lvzA:iis/POtrzbLp5dQ0T9qcU2lvzA
                                                                            MD5:25BDE25D332383D1228B2E66A4CB9F3E
                                                                            SHA1:CD5B9C3DD6AAB470D445E3956708A324E93A9160
                                                                            SHA-256:C8F7237E7040A73C2BEA567ACC9CEC373AADD48654AAAC6122416E160F08CA13
                                                                            SHA-512:CA2F2139BB456799C9F98EF8D89FD7C09D1972FA5DD8FC01B14B7AF00BF8D2C2175FB2C0C41E49A6DAF540E67943AAD338E33C1556FD6040EF06E0F25BFA88FA
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........q...q...q.....q..p...q..p...q..t...q..u...q..r...q.[.p...q...p.u.q.[.u...q.[.q...q.[.....q.[.s...q.Rich..q.........................PE..d.....wd.........." ...".D...T......<.....................................................`..........................................A...N..@U..........s........N......./......h.......8...............................@............@..@............................text....B.......D.................. ..`.rdata.../...`...0...H..............@..@.data...AM.......D...x..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............l..............@..@.rsrc...s............n..............@..@.reloc..q............v..............@..B................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\pyexpat.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):199448
                                                                            Entropy (8bit):6.377510350928234
                                                                            Encrypted:false
                                                                            SSDEEP:3072:OA1YT2Ga6xWK+RohrRoi9+IC08K9YSMJiCNi+GVwlijAOBgC4i9IPLhhHx:v1YOyGohNoEC08K9oJ5GWl7Fi
                                                                            MD5:9C21A5540FC572F75901820CF97245EC
                                                                            SHA1:09296F032A50DE7B398018F28EE8086DA915AEBD
                                                                            SHA-256:2FF8CD82E7CC255E219E7734498D2DEA0C65A5AB29DC8581240D40EB81246045
                                                                            SHA-512:4217268DB87EEC2F0A14B5881EDB3FDB8EFE7EA27D6DCBEE7602CA4997416C1130420F11167DAC7E781553F3611409FA37650B7C2B2D09F19DC190B17B410BA5
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T..5.5.5.Mu..5..I.5..I.5..I.5..I.5..I.5..M.5.5..5..I.5..I.5..I...5..I.5.Rich.5.................PE..d......d.........." ..."............0........................................ .......=....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\python311.dll

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):5762840
                                                                            Entropy (8bit):6.089392282930885
                                                                            Encrypted:false
                                                                            SSDEEP:49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgVr42I1vJHH++:73ZOKRtlrJ7wfGrs1BHeM+2PocL2
                                                                            MD5:5A5DD7CAD8028097842B0AFEF45BFBCF
                                                                            SHA1:E247A2E460687C607253949C52AE2801FF35DC4A
                                                                            SHA-256:A811C7516F531F1515D10743AE78004DD627EBA0DC2D3BC0D2E033B2722043CE
                                                                            SHA-512:E6268E4FAD2CE3EF16B68298A57498E16F0262BF3531539AD013A66F72DF471569F94C6FCC48154B7C3049A3AD15CBFCBB6345DACB4F4ED7D528C74D589C9858
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.D.5.*.5.*.5.*.z.+.7.*.z...;.*.z./.9.*.z...=.*.z.).1.*.<../.*.~.+.>.*.5.+.P.*...'..*...*.4.*.....4.*...(.4.*.Rich5.*.........................PE..d......d.........." ...".X%..47.....\H........................................\.......X...`...........................................@......WA......p[.......V.d0....W../....[..C....).T.............................).@............p%..............................text...rV%......X%................. ..`.rdata.......p%......\%.............@..@.data.........A..L...hA.............@....pdata..d0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......rV.............@..@.reloc...C....[..D...|V.............@..B........................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\select.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):30480
                                                                            Entropy (8bit):6.578957517354568
                                                                            Encrypted:false
                                                                            SSDEEP:384:N1ecReJKrHqDUI7A700EZ9IPQGNHQIYiSy1pCQn1tPxh8E9VF0NykfF:3eUeJGHqNbD9IPQGR5YiSyvnnPxWEuN
                                                                            MD5:C97A587E19227D03A85E90A04D7937F6
                                                                            SHA1:463703CF1CAC4E2297B442654FC6169B70CFB9BF
                                                                            SHA-256:C4AA9A106381835CFB5F9BADFB9D77DF74338BC66E69183757A5A3774CCDACCF
                                                                            SHA-512:97784363F3B0B794D2F9FD6A2C862D64910C71591006A34EEDFF989ECCA669AC245B3DFE68EAA6DA621209A3AB61D36E9118EBB4BE4C0E72CE80FAB7B43BDE12
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tB.t'B.t'B.t'K..'@.t'..u&@.t'..q&N.t'..p&J.t'..w&F.t'..u&@.t'B.u'..t'..u&G.t'..y&C.t'..t&C.t'...'C.t'..v&C.t'RichB.t'................PE..d......d.........." ...".....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

                                                                            C:\Users\user\AppData\Local\Temp\_MEI73042\unicodedata.pyd

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                            Category:dropped
                                                                            Size (bytes):1141016
                                                                            Entropy (8bit):5.435086202175289
                                                                            Encrypted:false
                                                                            SSDEEP:12288:83kYbfjwR6nblonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ol:8UYbMA0IDJcjEwPgPOG6Xyd461ol
                                                                            MD5:AA13EE6770452AF73828B55AF5CD1A32
                                                                            SHA1:C01ECE61C7623E36A834D8B3C660E7F28C91177E
                                                                            SHA-256:8FBED20E9225FF82132E97B4FEFBB5DDBC10C062D9E3F920A6616AB27BB5B0FB
                                                                            SHA-512:B2EEB9A7D4A32E91084FDAE302953AAC57388A5390F9404D8DFE5C4A8F66CA2AB73253CF5BA4CC55350D8306230DD1114A61E22C23F42FBCC5C0098046E97E0F
                                                                            Malicious:false
                                                                            Antivirus:
                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................,...............,.....,.....,.y...,.....Rich..........PE..d......d.........." ...".@..........P*...............................................!....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................

                                                                            \Device\ConDrv

                                                                            Download File
                                                                            Process:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            File Type:JSON data
                                                                            Category:dropped
                                                                            Size (bytes):74
                                                                            Entropy (8bit):4.562324021719868
                                                                            Encrypted:false
                                                                            SSDEEP:3:t/4IABFReNmI4hWQAuF5QEyn:mMmI4hWb3
                                                                            MD5:CD8074B6ED2C364CF10C22A3016376B3
                                                                            SHA1:1B8F1F62BD078640061C6B2589F2C91744EEAAD8
                                                                            SHA-256:A17A31EF1084B042E3F5E7B12FE536E6691AA30F9646EA36756DCC4814CF6D7A
                                                                            SHA-512:E76B110D58E8CC7B5F1EF80DB0B444A126C6A3B1CE601430648F5FD88A927945E0D671001EC0F930228B26968A459567C3E5902C5CF2D069E32B7DED5B6B380F
                                                                            Malicious:false
                                                                            Preview:[7364] Failed to execute script 'PDF_Resave' due to unhandled exception!..

                                                                            Static File Info

                                                                            General

                                                                            File type:PE32+ executable (console) x86-64, for MS Windows
                                                                            Entropy (8bit):7.9915710983981745
                                                                            TrID:
                                                                            • Win64 Executable Console (202006/5) 77.37%
                                                                            • InstallShield setup (43055/19) 16.49%
                                                                            • Win64 Executable (generic) (12005/4) 4.60%
                                                                            • Generic Win/DOS Executable (2004/3) 0.77%
                                                                            • DOS Executable Generic (2002/1) 0.77%
                                                                            File name:PDF_Resave.exe
                                                                            File size:7'729'425 bytes
                                                                            MD5:27cc92c02c64ebc1ffc0b19f361bd5a7
                                                                            SHA1:a715498ca0fd960b7b71bb6cfa0344569e59ee58
                                                                            SHA256:9a69ccfd07ee7573b8a7b5ccfa4c58c2f331c854fe3f97e08ed5d29e55824650
                                                                            SHA512:ceef40a63447370869e21f71caea774e97ebb18997eb5687f9e5f0903b9208eb7554feb61a062665b9ded691690b92cb0e6fb3e8e09370aaae18813abd8b8216
                                                                            SSDEEP:196608:cJDc4FMIZETKRjPePdrQJ/BNOqJVYPLbQ:TQETKRvJHOqjKbQ
                                                                            TLSH:20763389B2B109E8D523403CC582D868FA7674771778E28743F999AB2F538C2687FF15
                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R........................c...........y.L.....y.......y.......y.......................................Rich...................

                                                                            File Icon

                                                                            Icon Hash:2e1e7c4c4c61e979

                                                                            Static PE Info

                                                                            General

                                                                            Entrypoint:0x14000a6b0
                                                                            Entrypoint Section:.text
                                                                            Digitally signed:false
                                                                            Imagebase:0x140000000
                                                                            Subsystem:windows cui
                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                            Time Stamp:0x65F81ACE [Mon Mar 18 10:43:26 2024 UTC]
                                                                            TLS Callbacks:
                                                                            CLR (.Net) Version:
                                                                            OS Version Major:5
                                                                            OS Version Minor:2
                                                                            File Version Major:5
                                                                            File Version Minor:2
                                                                            Subsystem Version Major:5
                                                                            Subsystem Version Minor:2
                                                                            Import Hash:ba5546933531fafa869b1f86a4e2a959

                                                                            Entrypoint Preview

                                                                            Instruction
                                                                            dec eax
                                                                            sub esp, 28h
                                                                            call 00007F542CB176ECh
                                                                            dec eax
                                                                            add esp, 28h
                                                                            jmp 00007F542CB172EFh
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            dec eax
                                                                            sub esp, 28h
                                                                            call 00007F542CB17C34h
                                                                            test eax, eax
                                                                            je 00007F542CB174A3h
                                                                            dec eax
                                                                            mov eax, dword ptr [00000030h]
                                                                            dec eax
                                                                            mov ecx, dword ptr [eax+08h]
                                                                            jmp 00007F542CB17487h
                                                                            dec eax
                                                                            cmp ecx, eax
                                                                            je 00007F542CB17496h
                                                                            xor eax, eax
                                                                            dec eax
                                                                            cmpxchg dword ptr [00041E7Ch], ecx
                                                                            jne 00007F542CB17470h
                                                                            xor al, al
                                                                            dec eax
                                                                            add esp, 28h
                                                                            ret
                                                                            mov al, 01h
                                                                            jmp 00007F542CB17479h
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            inc eax
                                                                            push ebx
                                                                            dec eax
                                                                            sub esp, 20h
                                                                            movzx eax, byte ptr [00041E67h]
                                                                            test ecx, ecx
                                                                            mov ebx, 00000001h
                                                                            cmove eax, ebx
                                                                            mov byte ptr [00041E57h], al
                                                                            call 00007F542CB17A33h
                                                                            call 00007F542CB18B62h
                                                                            test al, al
                                                                            jne 00007F542CB17486h
                                                                            xor al, al
                                                                            jmp 00007F542CB17496h
                                                                            call 00007F542CB25F41h
                                                                            test al, al
                                                                            jne 00007F542CB1748Bh
                                                                            xor ecx, ecx
                                                                            call 00007F542CB18B72h
                                                                            jmp 00007F542CB1746Ch
                                                                            mov al, bl
                                                                            dec eax
                                                                            add esp, 20h
                                                                            pop ebx
                                                                            ret
                                                                            int3
                                                                            int3
                                                                            int3
                                                                            inc eax
                                                                            push ebx
                                                                            dec eax
                                                                            sub esp, 20h
                                                                            cmp byte ptr [00041E1Ch], 00000000h
                                                                            mov ebx, ecx
                                                                            jne 00007F542CB174E9h
                                                                            cmp ecx, 01h
                                                                            jnbe 00007F542CB174ECh
                                                                            call 00007F542CB17B9Ah
                                                                            test eax, eax
                                                                            je 00007F542CB174AAh

                                                                            Data Directories

                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3bb5c0x3c.rdata
                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xf00c.rsrc
                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20c4.pdata
                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x620000x75c.reloc
                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x393500x1c.rdata
                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392100x140.rdata
                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x350.rdata
                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                            Sections

                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                            .text0x10000x288a00x28a00cd519058a1cc7a614054b311d84d179bFalse0.5563401442307693zlib compressed data6.490694010276288IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                            .rdata0x2a0000x126e20x12800cf5ddfd901c106657758d0f946582b07False0.5156381967905406data5.846091788420925IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                            .data0x3d0000x103f80xe009bd2cebaa3285e8e266c4c373a15119dFalse0.13337053571428573DOS executable (block device driver \377\3)1.808915577448681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                            .pdata0x4e0000x20c40x220047e5659f5cd2366c7761336e5e8f1fbdFalse0.4763327205882353data5.30946295758841IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                            _RDATA0x510000x15c0x200739c14bf73dcb926054c7e1038da65e4False0.384765625data2.7733452366771543IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                            .rsrc0x520000xf00c0xf200b86a71d1708d58ca2afb06ba88c0c945False0.7951639979338843data7.356266549685757IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                            .reloc0x620000x75c0x800b7279c82d58eeae8dc663879402c6f2eFalse0.54296875data5.238892234772638IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                            Resources

                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                            RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                                                            RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                                                            RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                                                            RT_ICON0x53ec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                                                            RT_ICON0x5cf5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                                                            RT_ICON0x5f5040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                                                            RT_ICON0x605ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                                                            RT_GROUP_ICON0x60a140x68data0.7019230769230769
                                                                            RT_MANIFEST0x60a7c0x58fXML 1.0 document, ASCII text, with CRLF line terminators0.4483485593815882

                                                                            Imports

                                                                            DLLImport
                                                                            KERNEL32.dllGetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, WriteConsoleW, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, FreeLibrary, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, SetEndOfFile
                                                                            ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                            Network Behavior

                                                                            ⊘No network behavior found

                                                                            Statistics

                                                                            CPU Usage

                                                                            Click to jump to process

                                                                            Memory Usage

                                                                            Click to jump to process

                                                                            Behavior

                                                                            Click to jump to process

                                                                            System Behavior

                                                                            General

                                                                            Target ID:0
                                                                            Start time:09:44:23
                                                                            Start date:23/12/2024
                                                                            Path:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            Wow64 process (32bit):false
                                                                            Commandline:"C:\Users\user\Desktop\PDF_Resave.exe"
                                                                            Imagebase:0x7ff7bd3b0000
                                                                            File size:7'729'425 bytes
                                                                            MD5 hash:27CC92C02C64EBC1FFC0B19F361BD5A7
                                                                            Has elevated privileges:true
                                                                            Has administrator privileges:true
                                                                            Programmed in:C, C++ or other language
                                                                            Reputation:low
                                                                            Has exited:true

                                                                            General

                                                                            Target ID:1
                                                                            Start time:09:44:23
                                                                            Start date:23/12/2024
                                                                            Path:C:\Windows\System32\conhost.exe
                                                                            Wow64 process (32bit):false
                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            Imagebase:0x7ff7699e0000
                                                                            File size:862'208 bytes
                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                            Has elevated privileges:true
                                                                            Has administrator privileges:true
                                                                            Programmed in:C, C++ or other language
                                                                            Reputation:high
                                                                            Has exited:true

                                                                            General

                                                                            Target ID:2
                                                                            Start time:09:44:24
                                                                            Start date:23/12/2024
                                                                            Path:C:\Users\user\Desktop\PDF_Resave.exe
                                                                            Wow64 process (32bit):false
                                                                            Commandline:"C:\Users\user\Desktop\PDF_Resave.exe"
                                                                            Imagebase:0x7ff7bd3b0000
                                                                            File size:7'729'425 bytes
                                                                            MD5 hash:27CC92C02C64EBC1FFC0B19F361BD5A7
                                                                            Has elevated privileges:true
                                                                            Has administrator privileges:true
                                                                            Programmed in:C, C++ or other language
                                                                            Reputation:low
                                                                            Has exited:true

                                                                            Disassembly

                                                                            Reset < >

                                                                              Execution Graph

                                                                              Execution Coverage:11.8%
                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                              Signature Coverage:17.2%
                                                                              Total number of Nodes:2000
                                                                              Total number of Limit Nodes:69
                                                                              execution_graph 15121 7ff7bd3ce96c 15122 7ff7bd3ceb5e 15121->15122 15125 7ff7bd3ce9ae _isindst 15121->15125 15123 7ff7bd3c6098 _get_daylight 11 API calls 15122->15123 15141 7ff7bd3ceb4e 15123->15141 15125->15122 15127 7ff7bd3cea2e _isindst 15125->15127 15142 7ff7bd3d5444 15127->15142 15132 7ff7bd3ceb8a 15182 7ff7bd3c9f40 IsProcessorFeaturePresent 15132->15182 15139 7ff7bd3cea8b 15139->15141 15166 7ff7bd3d5488 15139->15166 15173 7ff7bd3ba110 15141->15173 15143 7ff7bd3d5453 15142->15143 15145 7ff7bd3cea4c 15142->15145 15186 7ff7bd3cf818 EnterCriticalSection 15143->15186 15148 7ff7bd3d4848 15145->15148 15149 7ff7bd3d4851 15148->15149 15153 7ff7bd3cea61 15148->15153 15150 7ff7bd3c6098 _get_daylight 11 API calls 15149->15150 15151 7ff7bd3d4856 15150->15151 15187 7ff7bd3c9f20 15151->15187 15153->15132 15154 7ff7bd3d4878 15153->15154 15155 7ff7bd3d4881 15154->15155 15157 7ff7bd3cea72 15154->15157 15156 7ff7bd3c6098 _get_daylight 11 API calls 15155->15156 15158 7ff7bd3d4886 15156->15158 15157->15132 15160 7ff7bd3d48a8 15157->15160 15159 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15158->15159 15159->15157 15161 7ff7bd3d48b1 15160->15161 15162 7ff7bd3cea83 15160->15162 15163 7ff7bd3c6098 _get_daylight 11 API calls 15161->15163 15162->15132 15162->15139 15164 7ff7bd3d48b6 15163->15164 15165 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15164->15165 15165->15162 15227 7ff7bd3cf818 EnterCriticalSection 15166->15227 15174 7ff7bd3ba119 15173->15174 15175 7ff7bd3ba124 15174->15175 15176 7ff7bd3ba1d0 IsProcessorFeaturePresent 15174->15176 15177 7ff7bd3ba1e8 15176->15177 15228 7ff7bd3ba3c4 RtlCaptureContext 15177->15228 15183 7ff7bd3c9f53 15182->15183 15233 7ff7bd3c9c54 15183->15233 15189 7ff7bd3c9db8 15187->15189 15190 7ff7bd3c9de3 15189->15190 15193 7ff7bd3c9e54 15190->15193 15192 7ff7bd3c9e0a 15201 7ff7bd3c9b9c 15193->15201 15197 7ff7bd3c9e8f 15197->15192 15199 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15200 7ff7bd3c9f1f 15199->15200 15202 7ff7bd3c9bf3 15201->15202 15203 7ff7bd3c9bb8 GetLastError 15201->15203 15202->15197 15207 7ff7bd3c9c08 15202->15207 15204 7ff7bd3c9bc8 15203->15204 15210 7ff7bd3ca9d0 15204->15210 15208 7ff7bd3c9c24 GetLastError SetLastError 15207->15208 15209 7ff7bd3c9c3c 15207->15209 15208->15209 15209->15197 15209->15199 15211 7ff7bd3ca9ef FlsGetValue 15210->15211 15212 7ff7bd3caa0a FlsSetValue 15210->15212 15213 7ff7bd3caa04 15211->15213 15216 7ff7bd3c9be3 SetLastError 15211->15216 15214 7ff7bd3caa17 15212->15214 15212->15216 15213->15212 15215 7ff7bd3cdec8 _get_daylight 11 API calls 15214->15215 15217 7ff7bd3caa26 15215->15217 15216->15202 15218 7ff7bd3caa44 FlsSetValue 15217->15218 15219 7ff7bd3caa34 FlsSetValue 15217->15219 15220 7ff7bd3caa50 FlsSetValue 15218->15220 15221 7ff7bd3caa62 15218->15221 15222 7ff7bd3caa3d 15219->15222 15220->15222 15223 7ff7bd3ca534 _get_daylight 11 API calls 15221->15223 15224 7ff7bd3c9f88 __free_lconv_num 11 API calls 15222->15224 15225 7ff7bd3caa6a 15223->15225 15224->15216 15226 7ff7bd3c9f88 __free_lconv_num 11 API calls 15225->15226 15226->15216 15229 7ff7bd3ba3de RtlLookupFunctionEntry 15228->15229 15230 7ff7bd3ba3f4 RtlVirtualUnwind 15229->15230 15231 7ff7bd3ba1fb 15229->15231 15230->15229 15230->15231 15232 7ff7bd3ba190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15231->15232 15234 7ff7bd3c9c8e _wfindfirst32i64 memcpy_s 15233->15234 15235 7ff7bd3c9cb6 RtlCaptureContext RtlLookupFunctionEntry 15234->15235 15236 7ff7bd3c9d26 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15235->15236 15237 7ff7bd3c9cf0 RtlVirtualUnwind 15235->15237 15238 7ff7bd3c9d78 _wfindfirst32i64 15236->15238 15237->15236 15239 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15238->15239 15240 7ff7bd3c9d97 GetCurrentProcess TerminateProcess 15239->15240 15048 7ff7bd3b9700 15049 7ff7bd3b972e 15048->15049 15050 7ff7bd3b9715 15048->15050 15050->15049 15053 7ff7bd3ccc3c 15050->15053 15054 7ff7bd3ccc87 15053->15054 15058 7ff7bd3ccc4b _get_daylight 15053->15058 15063 7ff7bd3c6098 15054->15063 15055 7ff7bd3ccc6e HeapAlloc 15057 7ff7bd3b978c 15055->15057 15055->15058 15058->15054 15058->15055 15060 7ff7bd3d2740 15058->15060 15066 7ff7bd3d2780 15060->15066 15072 7ff7bd3ca908 GetLastError 15063->15072 15065 7ff7bd3c60a1 15065->15057 15071 7ff7bd3cf818 EnterCriticalSection 15066->15071 15073 7ff7bd3ca949 FlsSetValue 15072->15073 15075 7ff7bd3ca92c 15072->15075 15074 7ff7bd3ca95b 15073->15074 15086 7ff7bd3ca939 SetLastError 15073->15086 15089 7ff7bd3cdec8 15074->15089 15075->15073 15075->15086 15079 7ff7bd3ca988 FlsSetValue 15082 7ff7bd3ca994 FlsSetValue 15079->15082 15083 7ff7bd3ca9a6 15079->15083 15080 7ff7bd3ca978 FlsSetValue 15081 7ff7bd3ca981 15080->15081 15096 7ff7bd3c9f88 15081->15096 15082->15081 15102 7ff7bd3ca534 15083->15102 15086->15065 15094 7ff7bd3cded9 _get_daylight 15089->15094 15090 7ff7bd3cdf2a 15092 7ff7bd3c6098 _get_daylight 10 API calls 15090->15092 15091 7ff7bd3cdf0e HeapAlloc 15093 7ff7bd3ca96a 15091->15093 15091->15094 15092->15093 15093->15079 15093->15080 15094->15090 15094->15091 15095 7ff7bd3d2740 _get_daylight 2 API calls 15094->15095 15095->15094 15097 7ff7bd3c9fbc 15096->15097 15098 7ff7bd3c9f8d RtlFreeHeap 15096->15098 15097->15086 15098->15097 15099 7ff7bd3c9fa8 GetLastError 15098->15099 15100 7ff7bd3c9fb5 __free_lconv_num 15099->15100 15101 7ff7bd3c6098 _get_daylight 9 API calls 15100->15101 15101->15097 15107 7ff7bd3ca40c 15102->15107 15119 7ff7bd3cf818 EnterCriticalSection 15107->15119 18790 7ff7bd3d0880 18801 7ff7bd3d67f4 18790->18801 18802 7ff7bd3d6801 18801->18802 18803 7ff7bd3c9f88 __free_lconv_num 11 API calls 18802->18803 18804 7ff7bd3d681d 18802->18804 18803->18802 18805 7ff7bd3c9f88 __free_lconv_num 11 API calls 18804->18805 18806 7ff7bd3d0889 18804->18806 18805->18804 18807 7ff7bd3cf818 EnterCriticalSection 18806->18807 19210 7ff7bd3ca610 19211 7ff7bd3ca615 19210->19211 19212 7ff7bd3ca62a 19210->19212 19216 7ff7bd3ca630 19211->19216 19217 7ff7bd3ca672 19216->19217 19218 7ff7bd3ca67a 19216->19218 19219 7ff7bd3c9f88 __free_lconv_num 11 API calls 19217->19219 19220 7ff7bd3c9f88 __free_lconv_num 11 API calls 19218->19220 19219->19218 19221 7ff7bd3ca687 19220->19221 19222 7ff7bd3c9f88 __free_lconv_num 11 API calls 19221->19222 19223 7ff7bd3ca694 19222->19223 19224 7ff7bd3c9f88 __free_lconv_num 11 API calls 19223->19224 19225 7ff7bd3ca6a1 19224->19225 19226 7ff7bd3c9f88 __free_lconv_num 11 API calls 19225->19226 19227 7ff7bd3ca6ae 19226->19227 19228 7ff7bd3c9f88 __free_lconv_num 11 API calls 19227->19228 19229 7ff7bd3ca6bb 19228->19229 19230 7ff7bd3c9f88 __free_lconv_num 11 API calls 19229->19230 19231 7ff7bd3ca6c8 19230->19231 19232 7ff7bd3c9f88 __free_lconv_num 11 API calls 19231->19232 19233 7ff7bd3ca6d5 19232->19233 19234 7ff7bd3c9f88 __free_lconv_num 11 API calls 19233->19234 19235 7ff7bd3ca6e5 19234->19235 19236 7ff7bd3c9f88 __free_lconv_num 11 API calls 19235->19236 19237 7ff7bd3ca6f5 19236->19237 19242 7ff7bd3ca4d4 19237->19242 19256 7ff7bd3cf818 EnterCriticalSection 19242->19256 15241 7ff7bd3c6888 15242 7ff7bd3c68ef 15241->15242 15243 7ff7bd3c68b6 15241->15243 15242->15243 15245 7ff7bd3c68f4 FindFirstFileExW 15242->15245 15244 7ff7bd3c6098 _get_daylight 11 API calls 15243->15244 15246 7ff7bd3c68bb 15244->15246 15247 7ff7bd3c6916 GetLastError 15245->15247 15248 7ff7bd3c695d 15245->15248 15249 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15246->15249 15251 7ff7bd3c6921 15247->15251 15252 7ff7bd3c694d 15247->15252 15301 7ff7bd3c6af8 15248->15301 15268 7ff7bd3c68c6 15249->15268 15251->15252 15256 7ff7bd3c693d 15251->15256 15257 7ff7bd3c692b 15251->15257 15253 7ff7bd3c6098 _get_daylight 11 API calls 15252->15253 15253->15268 15255 7ff7bd3c6af8 _wfindfirst32i64 10 API calls 15260 7ff7bd3c6983 15255->15260 15258 7ff7bd3c6098 _get_daylight 11 API calls 15256->15258 15257->15252 15261 7ff7bd3c6930 15257->15261 15258->15268 15259 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15263 7ff7bd3c68da 15259->15263 15264 7ff7bd3c6af8 _wfindfirst32i64 10 API calls 15260->15264 15262 7ff7bd3c6098 _get_daylight 11 API calls 15261->15262 15262->15268 15265 7ff7bd3c6991 15264->15265 15308 7ff7bd3cf9b4 15265->15308 15268->15259 15269 7ff7bd3c69bb 15270 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15269->15270 15271 7ff7bd3c69cf 15270->15271 15272 7ff7bd3c69f9 15271->15272 15275 7ff7bd3c6a38 FindNextFileW 15271->15275 15273 7ff7bd3c6098 _get_daylight 11 API calls 15272->15273 15274 7ff7bd3c69fe 15273->15274 15278 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15274->15278 15276 7ff7bd3c6a88 15275->15276 15277 7ff7bd3c6a47 GetLastError 15275->15277 15282 7ff7bd3c6af8 _wfindfirst32i64 10 API calls 15276->15282 15279 7ff7bd3c6a52 15277->15279 15280 7ff7bd3c6a7b 15277->15280 15281 7ff7bd3c6a09 15278->15281 15279->15280 15286 7ff7bd3c6a6e 15279->15286 15287 7ff7bd3c6a5c 15279->15287 15283 7ff7bd3c6098 _get_daylight 11 API calls 15280->15283 15288 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15281->15288 15284 7ff7bd3c6aa0 15282->15284 15283->15281 15285 7ff7bd3c6af8 _wfindfirst32i64 10 API calls 15284->15285 15289 7ff7bd3c6aae 15285->15289 15291 7ff7bd3c6098 _get_daylight 11 API calls 15286->15291 15287->15280 15290 7ff7bd3c6a61 15287->15290 15292 7ff7bd3c6a1c 15288->15292 15293 7ff7bd3c6af8 _wfindfirst32i64 10 API calls 15289->15293 15294 7ff7bd3c6098 _get_daylight 11 API calls 15290->15294 15291->15281 15295 7ff7bd3c6abc 15293->15295 15294->15281 15296 7ff7bd3cf9b4 _wfindfirst32i64 37 API calls 15295->15296 15297 7ff7bd3c6ada 15296->15297 15297->15281 15298 7ff7bd3c6ae2 15297->15298 15299 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15298->15299 15300 7ff7bd3c6af6 15299->15300 15302 7ff7bd3c6b10 15301->15302 15303 7ff7bd3c6b16 FileTimeToSystemTime 15301->15303 15302->15303 15306 7ff7bd3c6b3b 15302->15306 15304 7ff7bd3c6b25 SystemTimeToTzSpecificLocalTime 15303->15304 15303->15306 15304->15306 15305 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15307 7ff7bd3c6975 15305->15307 15306->15305 15307->15255 15309 7ff7bd3cf9c1 15308->15309 15310 7ff7bd3cf9cb 15308->15310 15309->15310 15314 7ff7bd3cf9e7 15309->15314 15311 7ff7bd3c6098 _get_daylight 11 API calls 15310->15311 15316 7ff7bd3cf9d3 15311->15316 15312 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15313 7ff7bd3c69af 15312->15313 15313->15268 15313->15269 15314->15313 15315 7ff7bd3c6098 _get_daylight 11 API calls 15314->15315 15315->15316 15316->15312 19274 7ff7bd3d970d 19277 7ff7bd3c43a8 LeaveCriticalSection 19274->19277 18834 7ff7bd3d9587 18835 7ff7bd3d9597 18834->18835 18838 7ff7bd3c43a8 LeaveCriticalSection 18835->18838 19314 7ff7bd3d97a2 19315 7ff7bd3d97b1 19314->19315 19316 7ff7bd3d97bb 19314->19316 19318 7ff7bd3cf878 LeaveCriticalSection 19315->19318 15317 7ff7bd3cfa98 15318 7ff7bd3cfabc 15317->15318 15321 7ff7bd3cfacc 15317->15321 15319 7ff7bd3c6098 _get_daylight 11 API calls 15318->15319 15320 7ff7bd3cfac1 15319->15320 15322 7ff7bd3cfdac 15321->15322 15323 7ff7bd3cfaee 15321->15323 15324 7ff7bd3c6098 _get_daylight 11 API calls 15322->15324 15325 7ff7bd3cfb0f 15323->15325 15472 7ff7bd3d0154 15323->15472 15326 7ff7bd3cfdb1 15324->15326 15329 7ff7bd3cfb81 15325->15329 15331 7ff7bd3cfb35 15325->15331 15335 7ff7bd3cfb75 15325->15335 15328 7ff7bd3c9f88 __free_lconv_num 11 API calls 15326->15328 15328->15320 15333 7ff7bd3cdec8 _get_daylight 11 API calls 15329->15333 15348 7ff7bd3cfb44 15329->15348 15330 7ff7bd3cfc2e 15342 7ff7bd3cfc4b 15330->15342 15349 7ff7bd3cfc9d 15330->15349 15487 7ff7bd3c868c 15331->15487 15336 7ff7bd3cfb97 15333->15336 15335->15330 15335->15348 15493 7ff7bd3d653c 15335->15493 15339 7ff7bd3c9f88 __free_lconv_num 11 API calls 15336->15339 15338 7ff7bd3c9f88 __free_lconv_num 11 API calls 15338->15320 15344 7ff7bd3cfba5 15339->15344 15340 7ff7bd3cfb3f 15345 7ff7bd3c6098 _get_daylight 11 API calls 15340->15345 15341 7ff7bd3cfb5d 15341->15335 15347 7ff7bd3d0154 45 API calls 15341->15347 15343 7ff7bd3c9f88 __free_lconv_num 11 API calls 15342->15343 15346 7ff7bd3cfc54 15343->15346 15344->15335 15344->15348 15352 7ff7bd3cdec8 _get_daylight 11 API calls 15344->15352 15345->15348 15362 7ff7bd3cfc59 15346->15362 15529 7ff7bd3d258c 15346->15529 15347->15335 15348->15338 15349->15348 15350 7ff7bd3d258c 40 API calls 15349->15350 15351 7ff7bd3cfcda 15350->15351 15353 7ff7bd3c9f88 __free_lconv_num 11 API calls 15351->15353 15355 7ff7bd3cfbc7 15352->15355 15356 7ff7bd3cfce4 15353->15356 15359 7ff7bd3c9f88 __free_lconv_num 11 API calls 15355->15359 15356->15348 15356->15362 15357 7ff7bd3cfda0 15360 7ff7bd3c9f88 __free_lconv_num 11 API calls 15357->15360 15358 7ff7bd3cfc85 15361 7ff7bd3c9f88 __free_lconv_num 11 API calls 15358->15361 15359->15335 15360->15320 15361->15362 15362->15357 15363 7ff7bd3cdec8 _get_daylight 11 API calls 15362->15363 15364 7ff7bd3cfd28 15363->15364 15365 7ff7bd3cfd30 15364->15365 15366 7ff7bd3cfd39 15364->15366 15368 7ff7bd3c9f88 __free_lconv_num 11 API calls 15365->15368 15448 7ff7bd3c931c 15366->15448 15370 7ff7bd3cfd37 15368->15370 15375 7ff7bd3c9f88 __free_lconv_num 11 API calls 15370->15375 15371 7ff7bd3cfd50 15538 7ff7bd3d6654 15371->15538 15372 7ff7bd3cfddb 15374 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15372->15374 15377 7ff7bd3cfdef 15374->15377 15375->15320 15380 7ff7bd3cfe18 15377->15380 15385 7ff7bd3cfe28 15377->15385 15378 7ff7bd3cfd77 15381 7ff7bd3c6098 _get_daylight 11 API calls 15378->15381 15379 7ff7bd3cfd98 15383 7ff7bd3c9f88 __free_lconv_num 11 API calls 15379->15383 15382 7ff7bd3c6098 _get_daylight 11 API calls 15380->15382 15384 7ff7bd3cfd7c 15381->15384 15407 7ff7bd3cfe1d 15382->15407 15383->15357 15387 7ff7bd3c9f88 __free_lconv_num 11 API calls 15384->15387 15386 7ff7bd3d010b 15385->15386 15388 7ff7bd3cfe4a 15385->15388 15389 7ff7bd3c6098 _get_daylight 11 API calls 15386->15389 15387->15370 15390 7ff7bd3cfe67 15388->15390 15457 7ff7bd3d023c 15388->15457 15391 7ff7bd3d0110 15389->15391 15394 7ff7bd3cfedb 15390->15394 15396 7ff7bd3cfe8f 15390->15396 15402 7ff7bd3cfecf 15390->15402 15393 7ff7bd3c9f88 __free_lconv_num 11 API calls 15391->15393 15393->15407 15398 7ff7bd3cff03 15394->15398 15403 7ff7bd3cdec8 _get_daylight 11 API calls 15394->15403 15418 7ff7bd3cfe9e 15394->15418 15395 7ff7bd3cff8e 15406 7ff7bd3cffab 15395->15406 15415 7ff7bd3cfffe 15395->15415 15557 7ff7bd3c86c8 15396->15557 15400 7ff7bd3cdec8 _get_daylight 11 API calls 15398->15400 15398->15402 15398->15418 15405 7ff7bd3cff25 15400->15405 15401 7ff7bd3c9f88 __free_lconv_num 11 API calls 15401->15407 15402->15395 15402->15418 15563 7ff7bd3d63fc 15402->15563 15408 7ff7bd3cfef5 15403->15408 15411 7ff7bd3c9f88 __free_lconv_num 11 API calls 15405->15411 15412 7ff7bd3c9f88 __free_lconv_num 11 API calls 15406->15412 15413 7ff7bd3c9f88 __free_lconv_num 11 API calls 15408->15413 15409 7ff7bd3cfeb7 15409->15402 15417 7ff7bd3d023c 45 API calls 15409->15417 15410 7ff7bd3cfe99 15414 7ff7bd3c6098 _get_daylight 11 API calls 15410->15414 15411->15402 15416 7ff7bd3cffb4 15412->15416 15413->15398 15414->15418 15415->15418 15419 7ff7bd3d258c 40 API calls 15415->15419 15422 7ff7bd3d258c 40 API calls 15416->15422 15425 7ff7bd3cffba 15416->15425 15417->15402 15418->15401 15420 7ff7bd3d003c 15419->15420 15421 7ff7bd3c9f88 __free_lconv_num 11 API calls 15420->15421 15423 7ff7bd3d0046 15421->15423 15426 7ff7bd3cffe6 15422->15426 15423->15418 15423->15425 15424 7ff7bd3d00ff 15427 7ff7bd3c9f88 __free_lconv_num 11 API calls 15424->15427 15425->15424 15429 7ff7bd3cdec8 _get_daylight 11 API calls 15425->15429 15428 7ff7bd3c9f88 __free_lconv_num 11 API calls 15426->15428 15427->15407 15428->15425 15430 7ff7bd3d008b 15429->15430 15431 7ff7bd3d0093 15430->15431 15432 7ff7bd3d009c 15430->15432 15434 7ff7bd3c9f88 __free_lconv_num 11 API calls 15431->15434 15433 7ff7bd3cf9b4 _wfindfirst32i64 37 API calls 15432->15433 15436 7ff7bd3d00aa 15433->15436 15435 7ff7bd3d009a 15434->15435 15442 7ff7bd3c9f88 __free_lconv_num 11 API calls 15435->15442 15437 7ff7bd3d013f 15436->15437 15438 7ff7bd3d00b2 SetEnvironmentVariableW 15436->15438 15441 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15437->15441 15439 7ff7bd3d00d6 15438->15439 15440 7ff7bd3d00f7 15438->15440 15443 7ff7bd3c6098 _get_daylight 11 API calls 15439->15443 15445 7ff7bd3c9f88 __free_lconv_num 11 API calls 15440->15445 15444 7ff7bd3d0153 15441->15444 15442->15407 15446 7ff7bd3d00db 15443->15446 15445->15424 15447 7ff7bd3c9f88 __free_lconv_num 11 API calls 15446->15447 15447->15435 15449 7ff7bd3c9333 15448->15449 15450 7ff7bd3c9329 15448->15450 15451 7ff7bd3c6098 _get_daylight 11 API calls 15449->15451 15450->15449 15455 7ff7bd3c934e 15450->15455 15452 7ff7bd3c933a 15451->15452 15453 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15452->15453 15454 7ff7bd3c9346 15453->15454 15454->15371 15454->15372 15455->15454 15456 7ff7bd3c6098 _get_daylight 11 API calls 15455->15456 15456->15452 15458 7ff7bd3d025f 15457->15458 15459 7ff7bd3d027c 15457->15459 15458->15390 15460 7ff7bd3cdec8 _get_daylight 11 API calls 15459->15460 15465 7ff7bd3d02a0 15460->15465 15461 7ff7bd3d0301 15463 7ff7bd3c9f88 __free_lconv_num 11 API calls 15461->15463 15463->15458 15465->15461 15466 7ff7bd3cdec8 _get_daylight 11 API calls 15465->15466 15467 7ff7bd3c9f88 __free_lconv_num 11 API calls 15465->15467 15468 7ff7bd3cf9b4 _wfindfirst32i64 37 API calls 15465->15468 15469 7ff7bd3d0310 15465->15469 15471 7ff7bd3d0324 15465->15471 15466->15465 15467->15465 15468->15465 15470 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15469->15470 15470->15471 15587 7ff7bd3c937c 15471->15587 15473 7ff7bd3d0189 15472->15473 15480 7ff7bd3d0171 15472->15480 15474 7ff7bd3cdec8 _get_daylight 11 API calls 15473->15474 15482 7ff7bd3d01ad 15474->15482 15475 7ff7bd3d0232 15477 7ff7bd3c937c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15475->15477 15476 7ff7bd3d020e 15478 7ff7bd3c9f88 __free_lconv_num 11 API calls 15476->15478 15479 7ff7bd3d0238 15477->15479 15478->15480 15480->15325 15481 7ff7bd3cdec8 _get_daylight 11 API calls 15481->15482 15482->15475 15482->15476 15482->15481 15483 7ff7bd3c9f88 __free_lconv_num 11 API calls 15482->15483 15484 7ff7bd3c931c __std_exception_copy 37 API calls 15482->15484 15485 7ff7bd3d021d 15482->15485 15483->15482 15484->15482 15486 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15485->15486 15486->15475 15488 7ff7bd3c869c 15487->15488 15491 7ff7bd3c86a5 15487->15491 15488->15491 15653 7ff7bd3c8164 15488->15653 15491->15340 15491->15341 15494 7ff7bd3d56ec 15493->15494 15495 7ff7bd3d6549 15493->15495 15496 7ff7bd3d56f9 15494->15496 15502 7ff7bd3d572f 15494->15502 15497 7ff7bd3c4a94 45 API calls 15495->15497 15500 7ff7bd3c6098 _get_daylight 11 API calls 15496->15500 15516 7ff7bd3d56a0 15496->15516 15499 7ff7bd3d657d 15497->15499 15498 7ff7bd3d5759 15501 7ff7bd3c6098 _get_daylight 11 API calls 15498->15501 15503 7ff7bd3d6582 15499->15503 15508 7ff7bd3d6593 15499->15508 15511 7ff7bd3d65aa 15499->15511 15504 7ff7bd3d5703 15500->15504 15506 7ff7bd3d575e 15501->15506 15502->15498 15507 7ff7bd3d577e 15502->15507 15503->15335 15505 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15504->15505 15509 7ff7bd3d570e 15505->15509 15510 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15506->15510 15517 7ff7bd3c4a94 45 API calls 15507->15517 15522 7ff7bd3d5769 15507->15522 15512 7ff7bd3c6098 _get_daylight 11 API calls 15508->15512 15509->15335 15510->15522 15514 7ff7bd3d65b4 15511->15514 15515 7ff7bd3d65c6 15511->15515 15513 7ff7bd3d6598 15512->15513 15518 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15513->15518 15519 7ff7bd3c6098 _get_daylight 11 API calls 15514->15519 15520 7ff7bd3d65ee 15515->15520 15521 7ff7bd3d65d7 15515->15521 15516->15335 15517->15522 15518->15503 15523 7ff7bd3d65b9 15519->15523 15948 7ff7bd3d8418 15520->15948 15939 7ff7bd3d573c 15521->15939 15522->15335 15526 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15523->15526 15526->15503 15528 7ff7bd3c6098 _get_daylight 11 API calls 15528->15503 15530 7ff7bd3d25cb 15529->15530 15531 7ff7bd3d25ae 15529->15531 15535 7ff7bd3d25d5 15530->15535 15988 7ff7bd3d7048 15530->15988 15531->15530 15532 7ff7bd3d25bc 15531->15532 15533 7ff7bd3c6098 _get_daylight 11 API calls 15532->15533 15537 7ff7bd3d25c1 memcpy_s 15533->15537 15995 7ff7bd3cfa1c 15535->15995 15537->15358 15539 7ff7bd3c4a94 45 API calls 15538->15539 15540 7ff7bd3d66ba 15539->15540 15541 7ff7bd3d66c8 15540->15541 16007 7ff7bd3ce154 15540->16007 16010 7ff7bd3c457c 15541->16010 15545 7ff7bd3d67b4 15548 7ff7bd3d67c5 15545->15548 15549 7ff7bd3c9f88 __free_lconv_num 11 API calls 15545->15549 15546 7ff7bd3c4a94 45 API calls 15547 7ff7bd3d6737 15546->15547 15551 7ff7bd3ce154 5 API calls 15547->15551 15553 7ff7bd3d6740 15547->15553 15550 7ff7bd3cfd73 15548->15550 15552 7ff7bd3c9f88 __free_lconv_num 11 API calls 15548->15552 15549->15548 15550->15378 15550->15379 15551->15553 15552->15550 15554 7ff7bd3c457c 14 API calls 15553->15554 15555 7ff7bd3d679b 15554->15555 15555->15545 15556 7ff7bd3d67a3 SetEnvironmentVariableW 15555->15556 15556->15545 15558 7ff7bd3c86e1 15557->15558 15559 7ff7bd3c86d8 15557->15559 15558->15409 15558->15410 15559->15558 16037 7ff7bd3c81d8 15559->16037 15564 7ff7bd3d6409 15563->15564 15567 7ff7bd3d6436 15563->15567 15565 7ff7bd3d640e 15564->15565 15564->15567 15566 7ff7bd3c6098 _get_daylight 11 API calls 15565->15566 15569 7ff7bd3d6413 15566->15569 15568 7ff7bd3d647a 15567->15568 15571 7ff7bd3d6499 15567->15571 15584 7ff7bd3d646e __crtLCMapStringW 15567->15584 15570 7ff7bd3c6098 _get_daylight 11 API calls 15568->15570 15572 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15569->15572 15573 7ff7bd3d647f 15570->15573 15574 7ff7bd3d64a3 15571->15574 15575 7ff7bd3d64b5 15571->15575 15576 7ff7bd3d641e 15572->15576 15577 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15573->15577 15578 7ff7bd3c6098 _get_daylight 11 API calls 15574->15578 15579 7ff7bd3c4a94 45 API calls 15575->15579 15576->15402 15577->15584 15580 7ff7bd3d64a8 15578->15580 15581 7ff7bd3d64c2 15579->15581 15582 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15580->15582 15581->15584 16084 7ff7bd3d7fd4 15581->16084 15582->15584 15584->15402 15586 7ff7bd3c6098 _get_daylight 11 API calls 15586->15584 15596 7ff7bd3d2800 15587->15596 15622 7ff7bd3d27b8 15596->15622 15627 7ff7bd3cf818 EnterCriticalSection 15622->15627 15654 7ff7bd3c817d 15653->15654 15655 7ff7bd3c8179 15653->15655 15676 7ff7bd3d17c0 15654->15676 15655->15491 15668 7ff7bd3c84b8 15655->15668 15660 7ff7bd3c818f 15662 7ff7bd3c9f88 __free_lconv_num 11 API calls 15660->15662 15661 7ff7bd3c819b 15702 7ff7bd3c8248 15661->15702 15662->15655 15665 7ff7bd3c9f88 __free_lconv_num 11 API calls 15666 7ff7bd3c81c2 15665->15666 15667 7ff7bd3c9f88 __free_lconv_num 11 API calls 15666->15667 15667->15655 15669 7ff7bd3c84e1 15668->15669 15674 7ff7bd3c84fa 15668->15674 15669->15491 15670 7ff7bd3cf148 WideCharToMultiByte 15670->15674 15671 7ff7bd3cdec8 _get_daylight 11 API calls 15671->15674 15672 7ff7bd3c858a 15673 7ff7bd3c9f88 __free_lconv_num 11 API calls 15672->15673 15673->15669 15674->15669 15674->15670 15674->15671 15674->15672 15675 7ff7bd3c9f88 __free_lconv_num 11 API calls 15674->15675 15675->15674 15677 7ff7bd3d17cd 15676->15677 15678 7ff7bd3c8182 15676->15678 15721 7ff7bd3ca864 15677->15721 15682 7ff7bd3d1afc GetEnvironmentStringsW 15678->15682 15683 7ff7bd3c8187 15682->15683 15684 7ff7bd3d1b2c 15682->15684 15683->15660 15683->15661 15685 7ff7bd3cf148 WideCharToMultiByte 15684->15685 15686 7ff7bd3d1b7d 15685->15686 15687 7ff7bd3d1b84 FreeEnvironmentStringsW 15686->15687 15688 7ff7bd3ccc3c _fread_nolock 12 API calls 15686->15688 15687->15683 15689 7ff7bd3d1b97 15688->15689 15690 7ff7bd3d1b9f 15689->15690 15691 7ff7bd3d1ba8 15689->15691 15693 7ff7bd3c9f88 __free_lconv_num 11 API calls 15690->15693 15692 7ff7bd3cf148 WideCharToMultiByte 15691->15692 15695 7ff7bd3d1bcb 15692->15695 15694 7ff7bd3d1ba6 15693->15694 15694->15687 15696 7ff7bd3d1bcf 15695->15696 15697 7ff7bd3d1bd9 15695->15697 15698 7ff7bd3c9f88 __free_lconv_num 11 API calls 15696->15698 15699 7ff7bd3c9f88 __free_lconv_num 11 API calls 15697->15699 15700 7ff7bd3d1bd7 FreeEnvironmentStringsW 15698->15700 15699->15700 15700->15683 15703 7ff7bd3c826d 15702->15703 15704 7ff7bd3cdec8 _get_daylight 11 API calls 15703->15704 15714 7ff7bd3c82a3 15704->15714 15705 7ff7bd3c9f88 __free_lconv_num 11 API calls 15706 7ff7bd3c81a3 15705->15706 15706->15665 15707 7ff7bd3c831e 15708 7ff7bd3c9f88 __free_lconv_num 11 API calls 15707->15708 15708->15706 15709 7ff7bd3cdec8 _get_daylight 11 API calls 15709->15714 15710 7ff7bd3c830d 15933 7ff7bd3c8474 15710->15933 15712 7ff7bd3c931c __std_exception_copy 37 API calls 15712->15714 15714->15707 15714->15709 15714->15710 15714->15712 15716 7ff7bd3c8343 15714->15716 15717 7ff7bd3c82ab 15714->15717 15719 7ff7bd3c9f88 __free_lconv_num 11 API calls 15714->15719 15715 7ff7bd3c9f88 __free_lconv_num 11 API calls 15715->15717 15718 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 15716->15718 15717->15705 15720 7ff7bd3c8356 15718->15720 15719->15714 15722 7ff7bd3ca875 FlsGetValue 15721->15722 15723 7ff7bd3ca890 FlsSetValue 15721->15723 15724 7ff7bd3ca882 15722->15724 15725 7ff7bd3ca88a 15722->15725 15723->15724 15726 7ff7bd3ca89d 15723->15726 15727 7ff7bd3ca888 15724->15727 15728 7ff7bd3c937c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15724->15728 15725->15723 15729 7ff7bd3cdec8 _get_daylight 11 API calls 15726->15729 15741 7ff7bd3d1494 15727->15741 15730 7ff7bd3ca905 15728->15730 15731 7ff7bd3ca8ac 15729->15731 15732 7ff7bd3ca8ca FlsSetValue 15731->15732 15733 7ff7bd3ca8ba FlsSetValue 15731->15733 15734 7ff7bd3ca8d6 FlsSetValue 15732->15734 15735 7ff7bd3ca8e8 15732->15735 15736 7ff7bd3ca8c3 15733->15736 15734->15736 15737 7ff7bd3ca534 _get_daylight 11 API calls 15735->15737 15738 7ff7bd3c9f88 __free_lconv_num 11 API calls 15736->15738 15739 7ff7bd3ca8f0 15737->15739 15738->15724 15740 7ff7bd3c9f88 __free_lconv_num 11 API calls 15739->15740 15740->15727 15764 7ff7bd3d1704 15741->15764 15743 7ff7bd3d14c9 15779 7ff7bd3d1194 15743->15779 15746 7ff7bd3ccc3c _fread_nolock 12 API calls 15747 7ff7bd3d14f7 15746->15747 15748 7ff7bd3d14ff 15747->15748 15751 7ff7bd3d150e 15747->15751 15749 7ff7bd3c9f88 __free_lconv_num 11 API calls 15748->15749 15750 7ff7bd3d14e6 15749->15750 15750->15678 15751->15751 15786 7ff7bd3d183c 15751->15786 15754 7ff7bd3d160a 15755 7ff7bd3c6098 _get_daylight 11 API calls 15754->15755 15757 7ff7bd3d160f 15755->15757 15756 7ff7bd3d1665 15759 7ff7bd3d16cc 15756->15759 15797 7ff7bd3d0fc4 15756->15797 15760 7ff7bd3c9f88 __free_lconv_num 11 API calls 15757->15760 15758 7ff7bd3d1624 15758->15756 15761 7ff7bd3c9f88 __free_lconv_num 11 API calls 15758->15761 15763 7ff7bd3c9f88 __free_lconv_num 11 API calls 15759->15763 15760->15750 15761->15756 15763->15750 15765 7ff7bd3d1727 15764->15765 15767 7ff7bd3d1731 15765->15767 15812 7ff7bd3cf818 EnterCriticalSection 15765->15812 15769 7ff7bd3d17a3 15767->15769 15771 7ff7bd3c937c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15767->15771 15769->15743 15773 7ff7bd3d17bb 15771->15773 15774 7ff7bd3d1812 15773->15774 15776 7ff7bd3ca864 50 API calls 15773->15776 15774->15743 15777 7ff7bd3d17fc 15776->15777 15778 7ff7bd3d1494 65 API calls 15777->15778 15778->15774 15813 7ff7bd3c4a94 15779->15813 15782 7ff7bd3d11b4 GetOEMCP 15784 7ff7bd3d11db 15782->15784 15783 7ff7bd3d11c6 15783->15784 15785 7ff7bd3d11cb GetACP 15783->15785 15784->15746 15784->15750 15785->15784 15787 7ff7bd3d1194 47 API calls 15786->15787 15788 7ff7bd3d1869 15787->15788 15789 7ff7bd3d19bf 15788->15789 15791 7ff7bd3d18a6 IsValidCodePage 15788->15791 15796 7ff7bd3d18c0 memcpy_s 15788->15796 15790 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15789->15790 15792 7ff7bd3d1601 15790->15792 15791->15789 15793 7ff7bd3d18b7 15791->15793 15792->15754 15792->15758 15794 7ff7bd3d18e6 GetCPInfo 15793->15794 15793->15796 15794->15789 15794->15796 15845 7ff7bd3d12ac 15796->15845 15932 7ff7bd3cf818 EnterCriticalSection 15797->15932 15814 7ff7bd3c4ab3 15813->15814 15815 7ff7bd3c4ab8 15813->15815 15814->15782 15814->15783 15815->15814 15816 7ff7bd3ca790 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15815->15816 15817 7ff7bd3c4ad3 15816->15817 15821 7ff7bd3ccc9c 15817->15821 15822 7ff7bd3cccb1 15821->15822 15823 7ff7bd3c4af6 15821->15823 15822->15823 15829 7ff7bd3d24b4 15822->15829 15825 7ff7bd3ccd08 15823->15825 15826 7ff7bd3ccd30 15825->15826 15827 7ff7bd3ccd1d 15825->15827 15826->15814 15827->15826 15842 7ff7bd3d1820 15827->15842 15830 7ff7bd3ca790 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15829->15830 15831 7ff7bd3d24c3 15830->15831 15832 7ff7bd3d250e 15831->15832 15841 7ff7bd3cf818 EnterCriticalSection 15831->15841 15832->15823 15843 7ff7bd3ca790 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15842->15843 15844 7ff7bd3d1829 15843->15844 15846 7ff7bd3d12e9 GetCPInfo 15845->15846 15847 7ff7bd3d13df 15845->15847 15846->15847 15848 7ff7bd3d12fc 15846->15848 15849 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15847->15849 15856 7ff7bd3d1ff0 15848->15856 15851 7ff7bd3d147e 15849->15851 15851->15789 15857 7ff7bd3c4a94 45 API calls 15856->15857 15858 7ff7bd3d2032 15857->15858 15876 7ff7bd3ce880 15858->15876 15877 7ff7bd3ce889 MultiByteToWideChar 15876->15877 15934 7ff7bd3c8315 15933->15934 15935 7ff7bd3c8479 15933->15935 15934->15715 15936 7ff7bd3c84a2 15935->15936 15937 7ff7bd3c9f88 __free_lconv_num 11 API calls 15935->15937 15938 7ff7bd3c9f88 __free_lconv_num 11 API calls 15936->15938 15937->15935 15938->15934 15940 7ff7bd3d5770 15939->15940 15941 7ff7bd3d5759 15939->15941 15940->15941 15944 7ff7bd3d577e 15940->15944 15942 7ff7bd3c6098 _get_daylight 11 API calls 15941->15942 15943 7ff7bd3d575e 15942->15943 15945 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15943->15945 15946 7ff7bd3c4a94 45 API calls 15944->15946 15947 7ff7bd3d5769 15944->15947 15945->15947 15946->15947 15947->15503 15949 7ff7bd3c4a94 45 API calls 15948->15949 15950 7ff7bd3d843d 15949->15950 15953 7ff7bd3d8094 15950->15953 15955 7ff7bd3d80e2 15953->15955 15954 7ff7bd3ba110 _wfindfirst32i64 8 API calls 15956 7ff7bd3d6615 15954->15956 15957 7ff7bd3d8169 15955->15957 15959 7ff7bd3d8154 GetCPInfo 15955->15959 15962 7ff7bd3d816d 15955->15962 15956->15503 15956->15528 15958 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 15957->15958 15957->15962 15960 7ff7bd3d8201 15958->15960 15959->15957 15959->15962 15961 7ff7bd3ccc3c _fread_nolock 12 API calls 15960->15961 15960->15962 15963 7ff7bd3d8238 15960->15963 15961->15963 15962->15954 15963->15962 15964 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 15963->15964 15965 7ff7bd3d82a6 15964->15965 15966 7ff7bd3d8388 15965->15966 15967 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 15965->15967 15966->15962 15968 7ff7bd3c9f88 __free_lconv_num 11 API calls 15966->15968 15969 7ff7bd3d82cc 15967->15969 15968->15962 15969->15966 15970 7ff7bd3ccc3c _fread_nolock 12 API calls 15969->15970 15971 7ff7bd3d82f9 15969->15971 15970->15971 15971->15966 15972 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 15971->15972 15973 7ff7bd3d8370 15972->15973 15974 7ff7bd3d8376 15973->15974 15975 7ff7bd3d8390 15973->15975 15974->15966 15978 7ff7bd3c9f88 __free_lconv_num 11 API calls 15974->15978 15982 7ff7bd3ce198 15975->15982 15978->15966 15979 7ff7bd3d83cf 15979->15962 15981 7ff7bd3c9f88 __free_lconv_num 11 API calls 15979->15981 15980 7ff7bd3c9f88 __free_lconv_num 11 API calls 15980->15979 15981->15962 15983 7ff7bd3cdf40 __crtLCMapStringW 5 API calls 15982->15983 15984 7ff7bd3ce1d6 15983->15984 15985 7ff7bd3ce1de 15984->15985 15986 7ff7bd3ce400 __crtLCMapStringW 5 API calls 15984->15986 15985->15979 15985->15980 15987 7ff7bd3ce247 CompareStringW 15986->15987 15987->15985 15989 7ff7bd3d7051 15988->15989 15990 7ff7bd3d706a HeapSize 15988->15990 15991 7ff7bd3c6098 _get_daylight 11 API calls 15989->15991 15992 7ff7bd3d7056 15991->15992 15993 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 15992->15993 15994 7ff7bd3d7061 15993->15994 15994->15535 15996 7ff7bd3cfa31 15995->15996 15997 7ff7bd3cfa3b 15995->15997 15998 7ff7bd3ccc3c _fread_nolock 12 API calls 15996->15998 15999 7ff7bd3cfa40 15997->15999 16005 7ff7bd3cfa47 _get_daylight 15997->16005 16004 7ff7bd3cfa39 15998->16004 16000 7ff7bd3c9f88 __free_lconv_num 11 API calls 15999->16000 16000->16004 16001 7ff7bd3cfa4d 16003 7ff7bd3c6098 _get_daylight 11 API calls 16001->16003 16002 7ff7bd3cfa7a HeapReAlloc 16002->16004 16002->16005 16003->16004 16004->15537 16005->16001 16005->16002 16006 7ff7bd3d2740 _get_daylight 2 API calls 16005->16006 16006->16005 16008 7ff7bd3cdf40 __crtLCMapStringW 5 API calls 16007->16008 16009 7ff7bd3ce174 16008->16009 16009->15541 16011 7ff7bd3c45a6 16010->16011 16012 7ff7bd3c45ca 16010->16012 16016 7ff7bd3c9f88 __free_lconv_num 11 API calls 16011->16016 16021 7ff7bd3c45b5 16011->16021 16013 7ff7bd3c45cf 16012->16013 16014 7ff7bd3c4624 16012->16014 16017 7ff7bd3c45e4 16013->16017 16018 7ff7bd3c9f88 __free_lconv_num 11 API calls 16013->16018 16013->16021 16015 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 16014->16015 16025 7ff7bd3c4640 16015->16025 16016->16021 16019 7ff7bd3ccc3c _fread_nolock 12 API calls 16017->16019 16018->16017 16019->16021 16020 7ff7bd3c4647 GetLastError 16032 7ff7bd3c600c 16020->16032 16021->15545 16021->15546 16023 7ff7bd3c4682 16023->16021 16026 7ff7bd3ce880 _fread_nolock MultiByteToWideChar 16023->16026 16024 7ff7bd3c4675 16029 7ff7bd3ccc3c _fread_nolock 12 API calls 16024->16029 16025->16020 16025->16023 16025->16024 16028 7ff7bd3c9f88 __free_lconv_num 11 API calls 16025->16028 16030 7ff7bd3c46c6 16026->16030 16028->16024 16029->16023 16030->16020 16030->16021 16031 7ff7bd3c6098 _get_daylight 11 API calls 16031->16021 16033 7ff7bd3ca908 _get_daylight 11 API calls 16032->16033 16034 7ff7bd3c6019 __free_lconv_num 16033->16034 16035 7ff7bd3ca908 _get_daylight 11 API calls 16034->16035 16036 7ff7bd3c4654 16035->16036 16036->16031 16038 7ff7bd3c81f1 16037->16038 16039 7ff7bd3c81ed 16037->16039 16058 7ff7bd3d1c0c GetEnvironmentStringsW 16038->16058 16039->15558 16050 7ff7bd3c8598 16039->16050 16042 7ff7bd3c81fe 16044 7ff7bd3c9f88 __free_lconv_num 11 API calls 16042->16044 16043 7ff7bd3c820a 16065 7ff7bd3c8358 16043->16065 16044->16039 16047 7ff7bd3c9f88 __free_lconv_num 11 API calls 16048 7ff7bd3c8231 16047->16048 16049 7ff7bd3c9f88 __free_lconv_num 11 API calls 16048->16049 16049->16039 16051 7ff7bd3c85bb 16050->16051 16056 7ff7bd3c85d2 16050->16056 16051->15558 16052 7ff7bd3cdec8 _get_daylight 11 API calls 16052->16056 16053 7ff7bd3c8646 16055 7ff7bd3c9f88 __free_lconv_num 11 API calls 16053->16055 16054 7ff7bd3ce880 MultiByteToWideChar _fread_nolock 16054->16056 16055->16051 16056->16051 16056->16052 16056->16053 16056->16054 16057 7ff7bd3c9f88 __free_lconv_num 11 API calls 16056->16057 16057->16056 16059 7ff7bd3c81f6 16058->16059 16060 7ff7bd3d1c30 16058->16060 16059->16042 16059->16043 16061 7ff7bd3ccc3c _fread_nolock 12 API calls 16060->16061 16063 7ff7bd3d1c67 memcpy_s 16061->16063 16062 7ff7bd3c9f88 __free_lconv_num 11 API calls 16064 7ff7bd3d1c87 FreeEnvironmentStringsW 16062->16064 16063->16062 16064->16059 16066 7ff7bd3c8380 16065->16066 16067 7ff7bd3cdec8 _get_daylight 11 API calls 16066->16067 16079 7ff7bd3c83bb 16067->16079 16068 7ff7bd3c83c3 16069 7ff7bd3c9f88 __free_lconv_num 11 API calls 16068->16069 16070 7ff7bd3c8212 16069->16070 16070->16047 16071 7ff7bd3c843d 16072 7ff7bd3c9f88 __free_lconv_num 11 API calls 16071->16072 16072->16070 16073 7ff7bd3cdec8 _get_daylight 11 API calls 16073->16079 16074 7ff7bd3c842c 16076 7ff7bd3c8474 11 API calls 16074->16076 16075 7ff7bd3cf9b4 _wfindfirst32i64 37 API calls 16075->16079 16077 7ff7bd3c8434 16076->16077 16080 7ff7bd3c9f88 __free_lconv_num 11 API calls 16077->16080 16078 7ff7bd3c8460 16081 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 16078->16081 16079->16068 16079->16071 16079->16073 16079->16074 16079->16075 16079->16078 16082 7ff7bd3c9f88 __free_lconv_num 11 API calls 16079->16082 16080->16068 16083 7ff7bd3c8472 16081->16083 16082->16079 16086 7ff7bd3d7ffd __crtLCMapStringW 16084->16086 16085 7ff7bd3d64fe 16085->15584 16085->15586 16086->16085 16087 7ff7bd3ce198 6 API calls 16086->16087 16087->16085 18843 7ff7bd3d0630 18861 7ff7bd3cf818 EnterCriticalSection 18843->18861 16088 7ff7bd3ba52c 16109 7ff7bd3ba70c 16088->16109 16091 7ff7bd3ba683 16214 7ff7bd3baa3c IsProcessorFeaturePresent 16091->16214 16092 7ff7bd3ba54d __scrt_acquire_startup_lock 16094 7ff7bd3ba68d 16092->16094 16099 7ff7bd3ba56b __scrt_release_startup_lock 16092->16099 16095 7ff7bd3baa3c 7 API calls 16094->16095 16097 7ff7bd3ba698 __FrameHandler3::FrameUnwindToEmptyState 16095->16097 16096 7ff7bd3ba590 16098 7ff7bd3ba616 16117 7ff7bd3c8748 16098->16117 16099->16096 16099->16098 16203 7ff7bd3c8af4 16099->16203 16102 7ff7bd3ba61b 16123 7ff7bd3b1000 16102->16123 16106 7ff7bd3ba63f 16106->16097 16210 7ff7bd3ba8a0 16106->16210 16221 7ff7bd3bacdc 16109->16221 16112 7ff7bd3ba73b 16223 7ff7bd3c91fc 16112->16223 16116 7ff7bd3ba545 16116->16091 16116->16092 16118 7ff7bd3c8758 16117->16118 16122 7ff7bd3c876d 16117->16122 16119 7ff7bd3c81d8 40 API calls 16118->16119 16118->16122 16120 7ff7bd3c8776 16119->16120 16121 7ff7bd3c8598 12 API calls 16120->16121 16120->16122 16121->16122 16122->16102 16124 7ff7bd3b1011 16123->16124 16266 7ff7bd3b67d0 16124->16266 16126 7ff7bd3b1023 16273 7ff7bd3c4f8c 16126->16273 16128 7ff7bd3b27ab 16280 7ff7bd3b1af0 16128->16280 16132 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16133 7ff7bd3b28de 16132->16133 16208 7ff7bd3bab90 GetModuleHandleW 16133->16208 16134 7ff7bd3b27c9 16195 7ff7bd3b28ca 16134->16195 16296 7ff7bd3b2c50 16134->16296 16136 7ff7bd3b27fb 16136->16195 16299 7ff7bd3b5af0 16136->16299 16138 7ff7bd3b2817 16139 7ff7bd3b2863 16138->16139 16140 7ff7bd3b5af0 92 API calls 16138->16140 16314 7ff7bd3b6100 16139->16314 16145 7ff7bd3b2838 __std_exception_copy 16140->16145 16142 7ff7bd3b2878 16318 7ff7bd3b19d0 16142->16318 16145->16139 16150 7ff7bd3b6100 89 API calls 16145->16150 16146 7ff7bd3b296d 16148 7ff7bd3b2998 16146->16148 16426 7ff7bd3b24a0 16146->16426 16147 7ff7bd3b19d0 121 API calls 16149 7ff7bd3b28ae 16147->16149 16157 7ff7bd3b29db 16148->16157 16430 7ff7bd3b6dc0 16148->16430 16153 7ff7bd3b28b2 16149->16153 16154 7ff7bd3b28f0 16149->16154 16150->16139 16397 7ff7bd3b1c50 16153->16397 16154->16146 16403 7ff7bd3b2de0 16154->16403 16155 7ff7bd3b29b8 16158 7ff7bd3b29bd 16155->16158 16159 7ff7bd3b29ce SetDllDirectoryW 16155->16159 16329 7ff7bd3b4fa0 16157->16329 16160 7ff7bd3b1c50 86 API calls 16158->16160 16159->16157 16160->16195 16165 7ff7bd3b2912 16168 7ff7bd3b1c50 86 API calls 16165->16168 16168->16195 16169 7ff7bd3b29f8 16192 7ff7bd3b2a2a 16169->16192 16454 7ff7bd3b47a0 16169->16454 16170 7ff7bd3b2940 16170->16146 16171 7ff7bd3b2945 16170->16171 16422 7ff7bd3be61c 16171->16422 16172 7ff7bd3b2af6 16333 7ff7bd3b2330 16172->16333 16178 7ff7bd3b2a49 16185 7ff7bd3b2a95 16178->16185 16490 7ff7bd3b1b30 16178->16490 16179 7ff7bd3b2a2c 16180 7ff7bd3b49f0 FreeLibrary 16179->16180 16180->16192 16184 7ff7bd3b2b2b 16187 7ff7bd3b5af0 92 API calls 16184->16187 16185->16195 16494 7ff7bd3b22d0 16185->16494 16193 7ff7bd3b2b37 16187->16193 16189 7ff7bd3b2a1b 16484 7ff7bd3b4df0 16189->16484 16191 7ff7bd3b2ad1 16194 7ff7bd3b49f0 FreeLibrary 16191->16194 16192->16172 16192->16178 16193->16195 16350 7ff7bd3b6140 16193->16350 16194->16195 16195->16132 16204 7ff7bd3c8b0b 16203->16204 16205 7ff7bd3c8b2c 16203->16205 16204->16098 18683 7ff7bd3c9248 16205->18683 16209 7ff7bd3baba1 16208->16209 16209->16106 16212 7ff7bd3ba8b1 16210->16212 16211 7ff7bd3ba656 16211->16096 16212->16211 16213 7ff7bd3bbe38 __scrt_initialize_crt 7 API calls 16212->16213 16213->16211 16215 7ff7bd3baa62 _wfindfirst32i64 memcpy_s 16214->16215 16216 7ff7bd3baa81 RtlCaptureContext RtlLookupFunctionEntry 16215->16216 16217 7ff7bd3baae6 memcpy_s 16216->16217 16218 7ff7bd3baaaa RtlVirtualUnwind 16216->16218 16219 7ff7bd3bab18 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16217->16219 16218->16217 16220 7ff7bd3bab6a _wfindfirst32i64 16219->16220 16220->16094 16222 7ff7bd3ba72e __scrt_dllmain_crt_thread_attach 16221->16222 16222->16112 16222->16116 16224 7ff7bd3d265c 16223->16224 16225 7ff7bd3ba740 16224->16225 16233 7ff7bd3cbb60 16224->16233 16225->16116 16227 7ff7bd3bbe38 16225->16227 16228 7ff7bd3bbe40 16227->16228 16229 7ff7bd3bbe4a 16227->16229 16245 7ff7bd3bc1b4 16228->16245 16229->16116 16244 7ff7bd3cf818 EnterCriticalSection 16233->16244 16246 7ff7bd3bbe45 16245->16246 16247 7ff7bd3bc1c3 16245->16247 16249 7ff7bd3bc220 16246->16249 16253 7ff7bd3bc3f0 16247->16253 16250 7ff7bd3bc24b 16249->16250 16251 7ff7bd3bc24f 16250->16251 16252 7ff7bd3bc22e DeleteCriticalSection 16250->16252 16251->16229 16252->16250 16257 7ff7bd3bc258 16253->16257 16258 7ff7bd3bc372 TlsFree 16257->16258 16259 7ff7bd3bc29c __vcrt_FlsAlloc 16257->16259 16259->16258 16260 7ff7bd3bc2ca LoadLibraryExW 16259->16260 16261 7ff7bd3bc361 GetProcAddress 16259->16261 16265 7ff7bd3bc30d LoadLibraryExW 16259->16265 16262 7ff7bd3bc341 16260->16262 16263 7ff7bd3bc2eb GetLastError 16260->16263 16261->16258 16262->16261 16264 7ff7bd3bc358 FreeLibrary 16262->16264 16263->16259 16264->16261 16265->16259 16265->16262 16269 7ff7bd3b67ef 16266->16269 16267 7ff7bd3b67f7 __std_exception_copy 16267->16126 16268 7ff7bd3b6840 WideCharToMultiByte 16268->16269 16271 7ff7bd3b68e8 16268->16271 16269->16267 16269->16268 16269->16271 16272 7ff7bd3b6896 WideCharToMultiByte 16269->16272 16522 7ff7bd3b1cb0 16271->16522 16272->16269 16272->16271 16274 7ff7bd3cecd0 16273->16274 16276 7ff7bd3ced76 16274->16276 16277 7ff7bd3ced23 16274->16277 16275 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16279 7ff7bd3ced4c 16275->16279 16822 7ff7bd3ceba8 16276->16822 16277->16275 16279->16128 16281 7ff7bd3b1b05 16280->16281 16282 7ff7bd3b1b20 16281->16282 16830 7ff7bd3b1c10 16281->16830 16282->16195 16284 7ff7bd3b2cd0 16282->16284 16853 7ff7bd3ba140 16284->16853 16287 7ff7bd3b2d22 16855 7ff7bd3b6ed0 16287->16855 16288 7ff7bd3b2d0b 16289 7ff7bd3b1cb0 86 API calls 16288->16289 16291 7ff7bd3b2d1e 16289->16291 16294 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16291->16294 16293 7ff7bd3b1c50 86 API calls 16293->16291 16295 7ff7bd3b2d5f 16294->16295 16295->16134 16297 7ff7bd3b1b30 49 API calls 16296->16297 16298 7ff7bd3b2c6d 16297->16298 16298->16136 16300 7ff7bd3b5afa 16299->16300 16301 7ff7bd3b6dc0 88 API calls 16300->16301 16302 7ff7bd3b5b1c GetEnvironmentVariableW 16301->16302 16303 7ff7bd3b5b86 16302->16303 16304 7ff7bd3b5b34 ExpandEnvironmentStringsW 16302->16304 16306 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16303->16306 16305 7ff7bd3b6ed0 88 API calls 16304->16305 16307 7ff7bd3b5b5c 16305->16307 16308 7ff7bd3b5b98 16306->16308 16307->16303 16309 7ff7bd3b5b66 16307->16309 16308->16138 16866 7ff7bd3c927c 16309->16866 16312 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16313 7ff7bd3b5b7e 16312->16313 16313->16138 16315 7ff7bd3b6dc0 88 API calls 16314->16315 16316 7ff7bd3b6117 SetEnvironmentVariableW 16315->16316 16317 7ff7bd3b612f __std_exception_copy 16316->16317 16317->16142 16319 7ff7bd3b1b30 49 API calls 16318->16319 16320 7ff7bd3b1a00 16319->16320 16321 7ff7bd3b1b30 49 API calls 16320->16321 16327 7ff7bd3b1a7a 16320->16327 16322 7ff7bd3b1a22 16321->16322 16323 7ff7bd3b2c50 49 API calls 16322->16323 16322->16327 16324 7ff7bd3b1a3b 16323->16324 16873 7ff7bd3b17b0 16324->16873 16327->16146 16327->16147 16328 7ff7bd3be61c 74 API calls 16328->16327 16330 7ff7bd3b4fb5 16329->16330 16331 7ff7bd3b1c10 86 API calls 16330->16331 16332 7ff7bd3b29e0 16330->16332 16331->16332 16332->16192 16444 7ff7bd3b4c40 16332->16444 16334 7ff7bd3b23e4 16333->16334 16341 7ff7bd3b23a3 16333->16341 16335 7ff7bd3b2423 16334->16335 16336 7ff7bd3b1ab0 74 API calls 16334->16336 16337 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16335->16337 16336->16334 16338 7ff7bd3b2435 16337->16338 16338->16195 16343 7ff7bd3b6090 16338->16343 16341->16334 16946 7ff7bd3b1440 16341->16946 16980 7ff7bd3b1dc0 16341->16980 17035 7ff7bd3b1780 16341->17035 16344 7ff7bd3b6dc0 88 API calls 16343->16344 16345 7ff7bd3b60af 16344->16345 16346 7ff7bd3b6dc0 88 API calls 16345->16346 16347 7ff7bd3b60bf 16346->16347 16348 7ff7bd3c6828 38 API calls 16347->16348 16349 7ff7bd3b60cd __std_exception_copy 16348->16349 16349->16184 16351 7ff7bd3b6150 16350->16351 16352 7ff7bd3b6dc0 88 API calls 16351->16352 16353 7ff7bd3b6181 SetConsoleCtrlHandler GetStartupInfoW 16352->16353 16354 7ff7bd3b61e2 16353->16354 17829 7ff7bd3c92f4 16354->17829 16398 7ff7bd3b1c6e 16397->16398 16399 7ff7bd3b1b90 78 API calls 16398->16399 16400 7ff7bd3b1c8c 16399->16400 16401 7ff7bd3b1d00 86 API calls 16400->16401 16402 7ff7bd3b1c9b 16401->16402 16402->16195 16404 7ff7bd3b2dec 16403->16404 16405 7ff7bd3b6dc0 88 API calls 16404->16405 16406 7ff7bd3b2e17 16405->16406 16407 7ff7bd3b6dc0 88 API calls 16406->16407 16408 7ff7bd3b2e2a 16407->16408 17885 7ff7bd3c5548 16408->17885 16411 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16412 7ff7bd3b290a 16411->16412 16412->16165 16413 7ff7bd3b6370 16412->16413 16414 7ff7bd3b6394 16413->16414 16415 7ff7bd3beca4 73 API calls 16414->16415 16420 7ff7bd3b646b __std_exception_copy 16414->16420 16416 7ff7bd3b63ae 16415->16416 16416->16420 18264 7ff7bd3c7aac 16416->18264 16418 7ff7bd3beca4 73 API calls 16421 7ff7bd3b63c3 16418->16421 16419 7ff7bd3be96c _fread_nolock 53 API calls 16419->16421 16420->16170 16421->16418 16421->16419 16421->16420 16423 7ff7bd3be64c 16422->16423 18279 7ff7bd3be3f8 16423->18279 16425 7ff7bd3be665 16425->16165 16427 7ff7bd3b24e0 16426->16427 16429 7ff7bd3b24b7 16426->16429 16427->16148 16428 7ff7bd3b1780 86 API calls 16428->16429 16429->16427 16429->16428 16431 7ff7bd3b6de1 MultiByteToWideChar 16430->16431 16432 7ff7bd3b6e67 MultiByteToWideChar 16430->16432 16433 7ff7bd3b6e07 16431->16433 16437 7ff7bd3b6e2c 16431->16437 16434 7ff7bd3b6eaf 16432->16434 16435 7ff7bd3b6e8a 16432->16435 16436 7ff7bd3b1cb0 86 API calls 16433->16436 16434->16155 16438 7ff7bd3b1cb0 86 API calls 16435->16438 16439 7ff7bd3b6e1a 16436->16439 16437->16432 16441 7ff7bd3b6e42 16437->16441 16440 7ff7bd3b6e9d 16438->16440 16439->16155 16440->16155 16442 7ff7bd3b1cb0 86 API calls 16441->16442 16443 7ff7bd3b6e55 16442->16443 16443->16155 16445 7ff7bd3b4c64 16444->16445 16450 7ff7bd3b4c91 16444->16450 16446 7ff7bd3b4c8c 16445->16446 16447 7ff7bd3b1780 86 API calls 16445->16447 16449 7ff7bd3b4c87 __std_exception_copy memcpy_s 16445->16449 16445->16450 18290 7ff7bd3b12b0 16446->18290 16447->16445 16449->16169 16450->16449 18316 7ff7bd3b2e60 16450->18316 16452 7ff7bd3b4cf7 16452->16449 16453 7ff7bd3b1c50 86 API calls 16452->16453 16453->16449 16460 7ff7bd3b47ba memcpy_s 16454->16460 16455 7ff7bd3b48df 16458 7ff7bd3b2e60 49 API calls 16455->16458 16457 7ff7bd3b48fb 16461 7ff7bd3b1c50 86 API calls 16457->16461 16459 7ff7bd3b4958 16458->16459 16465 7ff7bd3b2e60 49 API calls 16459->16465 16460->16455 16460->16457 16462 7ff7bd3b2e60 49 API calls 16460->16462 16464 7ff7bd3b48c0 16460->16464 16471 7ff7bd3b1440 158 API calls 16460->16471 16472 7ff7bd3b48e1 16460->16472 18319 7ff7bd3b1650 16460->18319 16463 7ff7bd3b48f1 __std_exception_copy 16461->16463 16462->16460 16468 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16463->16468 16464->16455 16466 7ff7bd3b2e60 49 API calls 16464->16466 16467 7ff7bd3b4988 16465->16467 16466->16455 16470 7ff7bd3b2e60 49 API calls 16467->16470 16469 7ff7bd3b2a09 16468->16469 16469->16179 16474 7ff7bd3b4720 16469->16474 16470->16463 16471->16460 16473 7ff7bd3b1c50 86 API calls 16472->16473 16473->16463 18324 7ff7bd3b6320 16474->18324 16476 7ff7bd3b473c 16477 7ff7bd3b6320 89 API calls 16476->16477 16478 7ff7bd3b474f 16477->16478 16479 7ff7bd3b4785 16478->16479 16480 7ff7bd3b4767 16478->16480 16481 7ff7bd3b1c50 86 API calls 16479->16481 18328 7ff7bd3b50b0 GetProcAddress 16480->18328 16483 7ff7bd3b2a17 16481->16483 16483->16179 16483->16189 16485 7ff7bd3b4e14 16484->16485 16486 7ff7bd3b1c50 86 API calls 16485->16486 16489 7ff7bd3b4e8a 16485->16489 16489->16192 16491 7ff7bd3b1b55 16490->16491 16492 7ff7bd3c3c90 49 API calls 16491->16492 16493 7ff7bd3b1b78 16492->16493 16493->16185 18387 7ff7bd3b3ac0 16494->18387 16497 7ff7bd3b231d 16497->16191 16499 7ff7bd3b22f4 16499->16497 18443 7ff7bd3b3840 16499->18443 16529 7ff7bd3b1d00 16522->16529 16530 7ff7bd3b1d10 16529->16530 16554 7ff7bd3c3c90 16530->16554 16534 7ff7bd3b1d70 16587 7ff7bd3b1b90 16534->16587 16537 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16538 7ff7bd3b1cd7 GetLastError 16537->16538 16539 7ff7bd3b6680 16538->16539 16540 7ff7bd3b668c 16539->16540 16541 7ff7bd3b66a7 GetLastError 16540->16541 16542 7ff7bd3b66ad FormatMessageW 16540->16542 16541->16542 16543 7ff7bd3b66e0 16542->16543 16544 7ff7bd3b66fc WideCharToMultiByte 16542->16544 16545 7ff7bd3b1cb0 83 API calls 16543->16545 16546 7ff7bd3b6736 16544->16546 16547 7ff7bd3b66f3 16544->16547 16545->16547 16548 7ff7bd3b1cb0 83 API calls 16546->16548 16549 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16547->16549 16548->16547 16550 7ff7bd3b1ce4 16549->16550 16551 7ff7bd3b1be0 16550->16551 16552 7ff7bd3b1d00 86 API calls 16551->16552 16553 7ff7bd3b1c02 16552->16553 16553->16267 16557 7ff7bd3c3cea 16554->16557 16555 7ff7bd3c3d0f 16556 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16555->16556 16560 7ff7bd3c3d39 16556->16560 16557->16555 16558 7ff7bd3c3d4b 16557->16558 16591 7ff7bd3c16d4 16558->16591 16562 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16560->16562 16564 7ff7bd3b1d58 16562->16564 16563 7ff7bd3c9f88 __free_lconv_num 11 API calls 16563->16560 16572 7ff7bd3b6c00 MultiByteToWideChar 16564->16572 16565 7ff7bd3c3e28 16565->16563 16566 7ff7bd3c3dfd 16569 7ff7bd3c9f88 __free_lconv_num 11 API calls 16566->16569 16567 7ff7bd3c3e4c 16567->16565 16568 7ff7bd3c3e56 16567->16568 16571 7ff7bd3c9f88 __free_lconv_num 11 API calls 16568->16571 16569->16560 16570 7ff7bd3c3df4 16570->16565 16570->16566 16571->16560 16573 7ff7bd3b6c63 16572->16573 16574 7ff7bd3b6c49 16572->16574 16576 7ff7bd3b6c93 MultiByteToWideChar 16573->16576 16577 7ff7bd3b6c79 16573->16577 16575 7ff7bd3b1cb0 82 API calls 16574->16575 16586 7ff7bd3b6c5c __std_exception_copy 16575->16586 16579 7ff7bd3b6cd0 WideCharToMultiByte 16576->16579 16580 7ff7bd3b6cb6 16576->16580 16578 7ff7bd3b1cb0 82 API calls 16577->16578 16578->16586 16582 7ff7bd3b6d06 16579->16582 16585 7ff7bd3b6cfd 16579->16585 16581 7ff7bd3b1cb0 82 API calls 16580->16581 16581->16586 16584 7ff7bd3b6d2b WideCharToMultiByte 16582->16584 16582->16585 16583 7ff7bd3b1cb0 82 API calls 16583->16586 16584->16585 16584->16586 16585->16583 16586->16534 16588 7ff7bd3b1bb6 16587->16588 16807 7ff7bd3c3b6c 16588->16807 16590 7ff7bd3b1bcc 16590->16537 16592 7ff7bd3c1712 16591->16592 16593 7ff7bd3c1702 16591->16593 16594 7ff7bd3c171b 16592->16594 16603 7ff7bd3c1749 16592->16603 16595 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16593->16595 16596 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16594->16596 16597 7ff7bd3c1741 16595->16597 16596->16597 16597->16565 16597->16566 16597->16567 16597->16570 16600 7ff7bd3c19f8 16602 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16600->16602 16602->16593 16603->16593 16603->16597 16603->16600 16605 7ff7bd3c2624 16603->16605 16631 7ff7bd3c1eb4 16603->16631 16661 7ff7bd3c121c 16603->16661 16664 7ff7bd3c3840 16603->16664 16606 7ff7bd3c2666 16605->16606 16607 7ff7bd3c26d9 16605->16607 16608 7ff7bd3c2703 16606->16608 16609 7ff7bd3c266c 16606->16609 16610 7ff7bd3c2733 16607->16610 16611 7ff7bd3c26de 16607->16611 16688 7ff7bd3c0160 16608->16688 16616 7ff7bd3c2671 16609->16616 16619 7ff7bd3c2742 16609->16619 16610->16608 16610->16619 16629 7ff7bd3c269c 16610->16629 16612 7ff7bd3c26e0 16611->16612 16613 7ff7bd3c2713 16611->16613 16615 7ff7bd3c2681 16612->16615 16622 7ff7bd3c26ef 16612->16622 16695 7ff7bd3bfd50 16613->16695 16630 7ff7bd3c2771 16615->16630 16670 7ff7bd3c2f88 16615->16670 16616->16615 16620 7ff7bd3c26b4 16616->16620 16616->16629 16619->16630 16702 7ff7bd3c0570 16619->16702 16620->16630 16680 7ff7bd3c3444 16620->16680 16622->16608 16623 7ff7bd3c26f4 16622->16623 16623->16630 16684 7ff7bd3c35dc 16623->16684 16625 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16627 7ff7bd3c2a07 16625->16627 16627->16603 16629->16630 16709 7ff7bd3cdb70 16629->16709 16630->16625 16632 7ff7bd3c1ebf 16631->16632 16633 7ff7bd3c1ed5 16631->16633 16635 7ff7bd3c1f13 16632->16635 16636 7ff7bd3c2666 16632->16636 16637 7ff7bd3c26d9 16632->16637 16634 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16633->16634 16633->16635 16634->16635 16635->16603 16638 7ff7bd3c2703 16636->16638 16639 7ff7bd3c266c 16636->16639 16640 7ff7bd3c2733 16637->16640 16641 7ff7bd3c26de 16637->16641 16644 7ff7bd3c0160 38 API calls 16638->16644 16648 7ff7bd3c2671 16639->16648 16650 7ff7bd3c2742 16639->16650 16640->16638 16640->16650 16659 7ff7bd3c269c 16640->16659 16642 7ff7bd3c26e0 16641->16642 16643 7ff7bd3c2713 16641->16643 16645 7ff7bd3c2681 16642->16645 16652 7ff7bd3c26ef 16642->16652 16646 7ff7bd3bfd50 38 API calls 16643->16646 16644->16659 16647 7ff7bd3c2f88 47 API calls 16645->16647 16660 7ff7bd3c2771 16645->16660 16646->16659 16647->16659 16648->16645 16649 7ff7bd3c26b4 16648->16649 16648->16659 16654 7ff7bd3c3444 47 API calls 16649->16654 16649->16660 16651 7ff7bd3c0570 38 API calls 16650->16651 16650->16660 16651->16659 16652->16638 16653 7ff7bd3c26f4 16652->16653 16656 7ff7bd3c35dc 37 API calls 16653->16656 16653->16660 16654->16659 16655 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16657 7ff7bd3c2a07 16655->16657 16656->16659 16657->16603 16658 7ff7bd3cdb70 47 API calls 16658->16659 16659->16658 16659->16660 16660->16655 16782 7ff7bd3bf324 16661->16782 16665 7ff7bd3c3857 16664->16665 16799 7ff7bd3cccd0 16665->16799 16671 7ff7bd3c2faa 16670->16671 16719 7ff7bd3bf190 16671->16719 16676 7ff7bd3c3840 45 API calls 16678 7ff7bd3c30e7 16676->16678 16677 7ff7bd3c3840 45 API calls 16679 7ff7bd3c3170 16677->16679 16678->16677 16678->16678 16678->16679 16679->16629 16681 7ff7bd3c345c 16680->16681 16682 7ff7bd3c34c4 16680->16682 16681->16682 16683 7ff7bd3cdb70 47 API calls 16681->16683 16682->16629 16683->16682 16687 7ff7bd3c35fd 16684->16687 16685 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16686 7ff7bd3c362e 16685->16686 16686->16629 16687->16685 16687->16686 16689 7ff7bd3c0193 16688->16689 16690 7ff7bd3c01c2 16689->16690 16692 7ff7bd3c027f 16689->16692 16691 7ff7bd3bf190 12 API calls 16690->16691 16694 7ff7bd3c01ff 16690->16694 16691->16694 16693 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16692->16693 16693->16694 16694->16629 16696 7ff7bd3bfd83 16695->16696 16697 7ff7bd3bfdb2 16696->16697 16699 7ff7bd3bfe6f 16696->16699 16698 7ff7bd3bf190 12 API calls 16697->16698 16701 7ff7bd3bfdef 16697->16701 16698->16701 16700 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16699->16700 16700->16701 16701->16629 16703 7ff7bd3c05a3 16702->16703 16704 7ff7bd3c05d2 16703->16704 16707 7ff7bd3c068f 16703->16707 16705 7ff7bd3c060f 16704->16705 16706 7ff7bd3bf190 12 API calls 16704->16706 16705->16629 16706->16705 16708 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16707->16708 16708->16705 16711 7ff7bd3cdb98 16709->16711 16710 7ff7bd3cdbdd 16713 7ff7bd3cdb9d memcpy_s 16710->16713 16715 7ff7bd3cdbc6 memcpy_s 16710->16715 16716 7ff7bd3cf148 WideCharToMultiByte 16710->16716 16711->16710 16712 7ff7bd3c3840 45 API calls 16711->16712 16711->16713 16711->16715 16712->16710 16713->16629 16714 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16714->16713 16715->16713 16715->16714 16717 7ff7bd3cdcb9 16716->16717 16717->16713 16718 7ff7bd3cdcce GetLastError 16717->16718 16718->16713 16718->16715 16720 7ff7bd3bf1c7 16719->16720 16721 7ff7bd3bf1b6 16719->16721 16720->16721 16722 7ff7bd3ccc3c _fread_nolock 12 API calls 16720->16722 16727 7ff7bd3cd888 16721->16727 16723 7ff7bd3bf1f4 16722->16723 16724 7ff7bd3bf208 16723->16724 16725 7ff7bd3c9f88 __free_lconv_num 11 API calls 16723->16725 16726 7ff7bd3c9f88 __free_lconv_num 11 API calls 16724->16726 16725->16724 16726->16721 16728 7ff7bd3cd8a5 16727->16728 16729 7ff7bd3cd8d8 16727->16729 16730 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16728->16730 16729->16728 16731 7ff7bd3cd90a 16729->16731 16739 7ff7bd3c30c5 16730->16739 16737 7ff7bd3cda1d 16731->16737 16744 7ff7bd3cd952 16731->16744 16732 7ff7bd3cdb0f 16773 7ff7bd3ccd74 16732->16773 16734 7ff7bd3cdad5 16766 7ff7bd3cd10c 16734->16766 16736 7ff7bd3cdaa4 16759 7ff7bd3cd3ec 16736->16759 16737->16732 16737->16734 16737->16736 16740 7ff7bd3cda67 16737->16740 16741 7ff7bd3cda5d 16737->16741 16739->16676 16739->16678 16749 7ff7bd3cd61c 16740->16749 16741->16734 16743 7ff7bd3cda62 16741->16743 16743->16736 16743->16740 16744->16739 16745 7ff7bd3c931c __std_exception_copy 37 API calls 16744->16745 16746 7ff7bd3cda0a 16745->16746 16746->16739 16747 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 16746->16747 16748 7ff7bd3cdb6c 16747->16748 16750 7ff7bd3d325c 38 API calls 16749->16750 16751 7ff7bd3cd669 16750->16751 16752 7ff7bd3d2ca4 37 API calls 16751->16752 16754 7ff7bd3cd6c4 16752->16754 16753 7ff7bd3cd6c8 16753->16739 16754->16753 16755 7ff7bd3cd719 16754->16755 16757 7ff7bd3cd6e4 16754->16757 16756 7ff7bd3cd208 45 API calls 16755->16756 16756->16753 16758 7ff7bd3cd4c4 45 API calls 16757->16758 16758->16753 16760 7ff7bd3d325c 38 API calls 16759->16760 16761 7ff7bd3cd436 16760->16761 16762 7ff7bd3d2ca4 37 API calls 16761->16762 16763 7ff7bd3cd486 16762->16763 16764 7ff7bd3cd48a 16763->16764 16765 7ff7bd3cd4c4 45 API calls 16763->16765 16764->16739 16765->16764 16767 7ff7bd3d325c 38 API calls 16766->16767 16768 7ff7bd3cd157 16767->16768 16769 7ff7bd3d2ca4 37 API calls 16768->16769 16770 7ff7bd3cd1af 16769->16770 16771 7ff7bd3cd1b3 16770->16771 16772 7ff7bd3cd208 45 API calls 16770->16772 16771->16739 16772->16771 16774 7ff7bd3ccdec 16773->16774 16775 7ff7bd3ccdb9 16773->16775 16777 7ff7bd3cce04 16774->16777 16779 7ff7bd3cce85 16774->16779 16776 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16775->16776 16781 7ff7bd3ccde5 memcpy_s 16776->16781 16778 7ff7bd3cd10c 46 API calls 16777->16778 16778->16781 16780 7ff7bd3c3840 45 API calls 16779->16780 16779->16781 16780->16781 16781->16739 16783 7ff7bd3bf351 16782->16783 16784 7ff7bd3bf363 16782->16784 16785 7ff7bd3c6098 _get_daylight 11 API calls 16783->16785 16787 7ff7bd3bf370 16784->16787 16790 7ff7bd3bf3ad 16784->16790 16786 7ff7bd3bf356 16785->16786 16788 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 16786->16788 16789 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16787->16789 16796 7ff7bd3bf361 16788->16796 16789->16796 16791 7ff7bd3bf456 16790->16791 16793 7ff7bd3c6098 _get_daylight 11 API calls 16790->16793 16792 7ff7bd3c6098 _get_daylight 11 API calls 16791->16792 16791->16796 16795 7ff7bd3bf500 16792->16795 16794 7ff7bd3bf44b 16793->16794 16797 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 16794->16797 16798 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 16795->16798 16796->16603 16797->16791 16798->16796 16800 7ff7bd3c387f 16799->16800 16801 7ff7bd3ccce9 16799->16801 16803 7ff7bd3ccd3c 16800->16803 16801->16800 16802 7ff7bd3d24b4 45 API calls 16801->16802 16802->16800 16804 7ff7bd3ccd55 16803->16804 16805 7ff7bd3c388f 16803->16805 16804->16805 16806 7ff7bd3d1820 45 API calls 16804->16806 16805->16603 16806->16805 16809 7ff7bd3c3b96 16807->16809 16808 7ff7bd3c3bce 16810 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16808->16810 16809->16808 16811 7ff7bd3c3c01 16809->16811 16813 7ff7bd3c3bf7 16810->16813 16814 7ff7bd3bf150 16811->16814 16813->16590 16821 7ff7bd3c439c EnterCriticalSection 16814->16821 16829 7ff7bd3c439c EnterCriticalSection 16822->16829 16831 7ff7bd3b1d00 86 API calls 16830->16831 16832 7ff7bd3b1c37 16831->16832 16835 7ff7bd3c44f0 16832->16835 16836 7ff7bd3c451b 16835->16836 16839 7ff7bd3c43b4 16836->16839 16852 7ff7bd3c6d60 EnterCriticalSection 16839->16852 16854 7ff7bd3b2cdc GetModuleFileNameW 16853->16854 16854->16287 16854->16288 16856 7ff7bd3b6f62 WideCharToMultiByte 16855->16856 16857 7ff7bd3b6ef4 WideCharToMultiByte 16855->16857 16859 7ff7bd3b6f8f 16856->16859 16863 7ff7bd3b2d35 16856->16863 16858 7ff7bd3b6f1e 16857->16858 16862 7ff7bd3b6f35 16857->16862 16860 7ff7bd3b1cb0 86 API calls 16858->16860 16861 7ff7bd3b1cb0 86 API calls 16859->16861 16860->16863 16861->16863 16862->16856 16864 7ff7bd3b6f4b 16862->16864 16863->16291 16863->16293 16865 7ff7bd3b1cb0 86 API calls 16864->16865 16865->16863 16867 7ff7bd3b5b6e 16866->16867 16868 7ff7bd3c9293 16866->16868 16867->16312 16868->16867 16869 7ff7bd3c931c __std_exception_copy 37 API calls 16868->16869 16870 7ff7bd3c92c0 16869->16870 16870->16867 16871 7ff7bd3c9f40 _wfindfirst32i64 17 API calls 16870->16871 16872 7ff7bd3c92f0 16871->16872 16874 7ff7bd3b17e4 16873->16874 16875 7ff7bd3b17d4 16873->16875 16876 7ff7bd3b6370 83 API calls 16874->16876 16906 7ff7bd3b1842 16874->16906 16877 7ff7bd3b2de0 120 API calls 16875->16877 16878 7ff7bd3b1815 16876->16878 16877->16874 16878->16906 16907 7ff7bd3beca4 16878->16907 16880 7ff7bd3b182b 16883 7ff7bd3b182f 16880->16883 16884 7ff7bd3b184c 16880->16884 16881 7ff7bd3ba110 _wfindfirst32i64 8 API calls 16882 7ff7bd3b19c0 16881->16882 16882->16327 16882->16328 16885 7ff7bd3b1c10 86 API calls 16883->16885 16911 7ff7bd3be96c 16884->16911 16885->16906 16888 7ff7bd3b1867 16891 7ff7bd3b1c10 86 API calls 16888->16891 16889 7ff7bd3beca4 73 API calls 16890 7ff7bd3b18d1 16889->16890 16892 7ff7bd3b18e3 16890->16892 16893 7ff7bd3b18fe 16890->16893 16891->16906 16894 7ff7bd3b1c10 86 API calls 16892->16894 16895 7ff7bd3be96c _fread_nolock 53 API calls 16893->16895 16894->16906 16896 7ff7bd3b1913 16895->16896 16896->16888 16897 7ff7bd3b1925 16896->16897 16914 7ff7bd3be6e0 16897->16914 16900 7ff7bd3b193d 16901 7ff7bd3b1c50 86 API calls 16900->16901 16901->16906 16902 7ff7bd3b1993 16904 7ff7bd3be61c 74 API calls 16902->16904 16902->16906 16903 7ff7bd3b1950 16903->16902 16905 7ff7bd3b1c50 86 API calls 16903->16905 16904->16906 16905->16902 16906->16881 16908 7ff7bd3becd4 16907->16908 16920 7ff7bd3bea34 16908->16920 16910 7ff7bd3beced 16910->16880 16932 7ff7bd3be98c 16911->16932 16915 7ff7bd3be6e9 16914->16915 16916 7ff7bd3b1939 16914->16916 16917 7ff7bd3c6098 _get_daylight 11 API calls 16915->16917 16916->16900 16916->16903 16918 7ff7bd3be6ee 16917->16918 16919 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 16918->16919 16919->16916 16921 7ff7bd3bea9e 16920->16921 16922 7ff7bd3bea5e 16920->16922 16921->16922 16924 7ff7bd3beaaa 16921->16924 16923 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 16922->16923 16925 7ff7bd3bea85 16923->16925 16931 7ff7bd3c439c EnterCriticalSection 16924->16931 16925->16910 16933 7ff7bd3be9b6 16932->16933 16934 7ff7bd3b1861 16932->16934 16933->16934 16935 7ff7bd3bea02 16933->16935 16936 7ff7bd3be9c5 memcpy_s 16933->16936 16934->16888 16934->16889 16945 7ff7bd3c439c EnterCriticalSection 16935->16945 16939 7ff7bd3c6098 _get_daylight 11 API calls 16936->16939 16941 7ff7bd3be9da 16939->16941 16943 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 16941->16943 16943->16934 17039 7ff7bd3b5880 16946->17039 16948 7ff7bd3b1454 16949 7ff7bd3b1459 16948->16949 17048 7ff7bd3b5ba0 16948->17048 16949->16341 16952 7ff7bd3b14a7 16954 7ff7bd3b14e0 16952->16954 16956 7ff7bd3b2de0 120 API calls 16952->16956 16953 7ff7bd3b1487 16955 7ff7bd3b1c10 86 API calls 16953->16955 16957 7ff7bd3beca4 73 API calls 16954->16957 16974 7ff7bd3b149d 16955->16974 16958 7ff7bd3b14bf 16956->16958 16959 7ff7bd3b14f2 16957->16959 16958->16954 16960 7ff7bd3b14c7 16958->16960 16961 7ff7bd3b1516 16959->16961 16962 7ff7bd3b14f6 16959->16962 16963 7ff7bd3b1c50 86 API calls 16960->16963 16965 7ff7bd3b151c 16961->16965 16967 7ff7bd3b1534 16961->16967 16964 7ff7bd3b1c10 86 API calls 16962->16964 16972 7ff7bd3b14d6 __std_exception_copy 16963->16972 16964->16972 17073 7ff7bd3b1050 16965->17073 16968 7ff7bd3b1556 16967->16968 16979 7ff7bd3b1575 16967->16979 16971 7ff7bd3b1c10 86 API calls 16968->16971 16969 7ff7bd3b1624 16970 7ff7bd3be61c 74 API calls 16969->16970 16970->16974 16971->16972 16972->16969 16973 7ff7bd3be61c 74 API calls 16972->16973 16973->16969 16974->16341 16975 7ff7bd3be96c _fread_nolock 53 API calls 16975->16979 16976 7ff7bd3b15d5 16978 7ff7bd3b1c10 86 API calls 16976->16978 16978->16972 16979->16972 16979->16975 16979->16976 17091 7ff7bd3bf0ac 16979->17091 16981 7ff7bd3b1dd6 16980->16981 16982 7ff7bd3b1b30 49 API calls 16981->16982 16983 7ff7bd3b1e0b 16982->16983 16984 7ff7bd3b2c50 49 API calls 16983->16984 17012 7ff7bd3b2211 16983->17012 16985 7ff7bd3b1e7f 16984->16985 17641 7ff7bd3b2230 16985->17641 16988 7ff7bd3b1ec1 16990 7ff7bd3b5880 127 API calls 16988->16990 16989 7ff7bd3b1efa 16991 7ff7bd3b2230 75 API calls 16989->16991 16992 7ff7bd3b1ec9 16990->16992 16993 7ff7bd3b1f4c 16991->16993 16994 7ff7bd3b1eea 16992->16994 17649 7ff7bd3b5760 16992->17649 16995 7ff7bd3b1f50 16993->16995 16996 7ff7bd3b1fb6 16993->16996 16997 7ff7bd3b1c50 86 API calls 16994->16997 17001 7ff7bd3b1ef3 16994->17001 17000 7ff7bd3b5880 127 API calls 16995->17000 16999 7ff7bd3b2230 75 API calls 16996->16999 16997->17001 17002 7ff7bd3b1fe2 16999->17002 17004 7ff7bd3b1f58 17000->17004 17005 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17001->17005 17003 7ff7bd3b2042 17002->17003 17006 7ff7bd3b2230 75 API calls 17002->17006 17008 7ff7bd3b5880 127 API calls 17003->17008 17003->17012 17004->16994 17007 7ff7bd3b5760 138 API calls 17004->17007 17009 7ff7bd3b1fab 17005->17009 17010 7ff7bd3b2012 17006->17010 17011 7ff7bd3b1f75 17007->17011 17015 7ff7bd3b2052 17008->17015 17009->16341 17010->17003 17014 7ff7bd3b2230 75 API calls 17010->17014 17011->16994 17013 7ff7bd3b21f6 17011->17013 17014->17003 17015->17012 17036 7ff7bd3b17a1 17035->17036 17037 7ff7bd3b1795 17035->17037 17036->16341 17038 7ff7bd3b1c50 86 API calls 17037->17038 17038->17036 17040 7ff7bd3b58c8 17039->17040 17041 7ff7bd3b5892 17039->17041 17040->16948 17095 7ff7bd3b16d0 17041->17095 17049 7ff7bd3b5bb0 17048->17049 17050 7ff7bd3b1b30 49 API calls 17049->17050 17051 7ff7bd3b5be1 17050->17051 17052 7ff7bd3b5db0 17051->17052 17053 7ff7bd3b1b30 49 API calls 17051->17053 17054 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17052->17054 17056 7ff7bd3b5c08 17053->17056 17055 7ff7bd3b147f 17054->17055 17055->16952 17055->16953 17056->17052 17604 7ff7bd3c5168 17056->17604 17058 7ff7bd3b5d19 17059 7ff7bd3b6dc0 88 API calls 17058->17059 17062 7ff7bd3b5d31 17059->17062 17060 7ff7bd3b5c3d 17060->17052 17060->17058 17060->17060 17069 7ff7bd3c5168 49 API calls 17060->17069 17071 7ff7bd3b6dc0 88 API calls 17060->17071 17072 7ff7bd3b6a70 58 API calls 17060->17072 17061 7ff7bd3b5deb 17063 7ff7bd3b2de0 120 API calls 17061->17063 17062->17061 17064 7ff7bd3b5af0 92 API calls 17062->17064 17070 7ff7bd3b5d62 __std_exception_copy 17062->17070 17063->17052 17064->17070 17065 7ff7bd3b5d9f 17067 7ff7bd3b1c50 86 API calls 17065->17067 17066 7ff7bd3b1c50 86 API calls 17066->17061 17067->17052 17068 7ff7bd3b5dd3 17068->17066 17069->17060 17070->17065 17070->17068 17071->17060 17072->17060 17074 7ff7bd3b10a6 17073->17074 17075 7ff7bd3b10d3 17074->17075 17076 7ff7bd3b10ad 17074->17076 17079 7ff7bd3b1109 17075->17079 17080 7ff7bd3b10ed 17075->17080 17077 7ff7bd3b1c50 86 API calls 17076->17077 17078 7ff7bd3b10c0 17077->17078 17078->16972 17082 7ff7bd3b111b 17079->17082 17089 7ff7bd3b1137 memcpy_s 17079->17089 17081 7ff7bd3b1c10 86 API calls 17080->17081 17085 7ff7bd3b1104 __std_exception_copy 17081->17085 17083 7ff7bd3b1c10 86 API calls 17082->17083 17083->17085 17084 7ff7bd3be96c _fread_nolock 53 API calls 17084->17089 17085->16972 17086 7ff7bd3b11fe 17088 7ff7bd3bf0ac 76 API calls 17088->17089 17089->17084 17089->17085 17089->17086 17089->17088 17090 7ff7bd3be6e0 37 API calls 17089->17090 17090->17089 17092 7ff7bd3bf0dc 17091->17092 17626 7ff7bd3bedfc 17092->17626 17094 7ff7bd3bf0fa 17094->16979 17097 7ff7bd3b16f5 17095->17097 17096 7ff7bd3b1738 17099 7ff7bd3b58e0 17096->17099 17097->17096 17098 7ff7bd3b1c50 86 API calls 17097->17098 17098->17096 17100 7ff7bd3b58f6 17099->17100 17101 7ff7bd3b591a 17100->17101 17102 7ff7bd3b596d GetTempPathW GetCurrentProcessId 17100->17102 17104 7ff7bd3b5af0 92 API calls 17101->17104 17137 7ff7bd3b6620 17102->17137 17105 7ff7bd3b5926 17104->17105 17161 7ff7bd3b55e0 17105->17161 17111 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17113 7ff7bd3b58ad 17111->17113 17113->17040 17114 7ff7bd3b599b __std_exception_copy 17115 7ff7bd3b5a46 17114->17115 17118 7ff7bd3b59d1 17114->17118 17141 7ff7bd3c74e0 17114->17141 17144 7ff7bd3b6a70 17114->17144 17116 7ff7bd3b6ed0 88 API calls 17115->17116 17121 7ff7bd3b5a57 __std_exception_copy 17116->17121 17122 7ff7bd3b6dc0 88 API calls 17118->17122 17133 7ff7bd3b5a0a __std_exception_copy 17118->17133 17123 7ff7bd3b6dc0 88 API calls 17121->17123 17121->17133 17124 7ff7bd3b59e7 17122->17124 17133->17111 17138 7ff7bd3b6645 17137->17138 17195 7ff7bd3c3ee4 17138->17195 17367 7ff7bd3c710c 17141->17367 17145 7ff7bd3ba140 17144->17145 17146 7ff7bd3b6a80 GetCurrentProcess OpenProcessToken 17145->17146 17162 7ff7bd3b55ec 17161->17162 17163 7ff7bd3b6dc0 88 API calls 17162->17163 17164 7ff7bd3b560e 17163->17164 17165 7ff7bd3b5616 17164->17165 17166 7ff7bd3b5629 ExpandEnvironmentStringsW 17164->17166 17167 7ff7bd3b1c50 86 API calls 17165->17167 17168 7ff7bd3b564f __std_exception_copy 17166->17168 17169 7ff7bd3b5622 17167->17169 17170 7ff7bd3b5666 17168->17170 17171 7ff7bd3b5653 17168->17171 17172 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17169->17172 17175 7ff7bd3b5680 17170->17175 17176 7ff7bd3b5674 17170->17176 17173 7ff7bd3b1c50 86 API calls 17171->17173 17174 7ff7bd3b5748 17172->17174 17173->17169 17174->17133 17185 7ff7bd3c6828 17174->17185 17504 7ff7bd3c53c8 17175->17504 17497 7ff7bd3c60b8 17176->17497 17179 7ff7bd3b567e 17180 7ff7bd3b569a 17179->17180 17183 7ff7bd3b56ad memcpy_s 17179->17183 17186 7ff7bd3c6835 17185->17186 17187 7ff7bd3c6848 17185->17187 17188 7ff7bd3c6098 _get_daylight 11 API calls 17186->17188 17596 7ff7bd3c64ac 17187->17596 17199 7ff7bd3c3f3e 17195->17199 17196 7ff7bd3c3f63 17197 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 17196->17197 17212 7ff7bd3c3f8d 17197->17212 17198 7ff7bd3c3f9f 17213 7ff7bd3c1a54 17198->17213 17199->17196 17199->17198 17201 7ff7bd3c4080 17202 7ff7bd3c9f88 __free_lconv_num 11 API calls 17201->17202 17202->17212 17203 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17205 7ff7bd3b6664 17203->17205 17205->17114 17206 7ff7bd3c40a6 17206->17201 17209 7ff7bd3c40b0 17206->17209 17207 7ff7bd3c4055 17210 7ff7bd3c9f88 __free_lconv_num 11 API calls 17207->17210 17208 7ff7bd3c404c 17208->17201 17208->17207 17211 7ff7bd3c9f88 __free_lconv_num 11 API calls 17209->17211 17210->17212 17211->17212 17212->17203 17214 7ff7bd3c1a92 17213->17214 17215 7ff7bd3c1a82 17213->17215 17216 7ff7bd3c1a9b 17214->17216 17220 7ff7bd3c1ac9 17214->17220 17217 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 17215->17217 17218 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 17216->17218 17219 7ff7bd3c1ac1 17217->17219 17218->17219 17219->17201 17219->17206 17219->17207 17219->17208 17220->17215 17220->17219 17224 7ff7bd3c2a28 17220->17224 17257 7ff7bd3c203c 17220->17257 17294 7ff7bd3c12ac 17220->17294 17225 7ff7bd3c2a6a 17224->17225 17226 7ff7bd3c2adb 17224->17226 17229 7ff7bd3c2a70 17225->17229 17230 7ff7bd3c2b05 17225->17230 17227 7ff7bd3c2ae0 17226->17227 17228 7ff7bd3c2b34 17226->17228 17231 7ff7bd3c2ae2 17227->17231 17232 7ff7bd3c2b15 17227->17232 17235 7ff7bd3c2b4b 17228->17235 17237 7ff7bd3c2b3e 17228->17237 17242 7ff7bd3c2b43 17228->17242 17233 7ff7bd3c2a75 17229->17233 17234 7ff7bd3c2aa4 17229->17234 17313 7ff7bd3c0364 17230->17313 17236 7ff7bd3c2a84 17231->17236 17246 7ff7bd3c2af1 17231->17246 17320 7ff7bd3bff54 17232->17320 17233->17235 17238 7ff7bd3c2a7b 17233->17238 17234->17238 17234->17242 17327 7ff7bd3c3730 17235->17327 17255 7ff7bd3c2b74 17236->17255 17297 7ff7bd3c31dc 17236->17297 17237->17230 17237->17242 17238->17236 17245 7ff7bd3c2ab6 17238->17245 17253 7ff7bd3c2a9f 17238->17253 17242->17255 17331 7ff7bd3c0774 17242->17331 17245->17255 17246->17230 17247 7ff7bd3c2af6 17246->17247 17247->17255 17253->17255 17258 7ff7bd3c2060 17257->17258 17259 7ff7bd3c204a 17257->17259 17260 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 17258->17260 17261 7ff7bd3c20a0 17258->17261 17259->17261 17262 7ff7bd3c2a6a 17259->17262 17263 7ff7bd3c2adb 17259->17263 17260->17261 17261->17220 17266 7ff7bd3c2a70 17262->17266 17267 7ff7bd3c2b05 17262->17267 17264 7ff7bd3c2ae0 17263->17264 17265 7ff7bd3c2b34 17263->17265 17268 7ff7bd3c2ae2 17264->17268 17269 7ff7bd3c2b15 17264->17269 17272 7ff7bd3c2b4b 17265->17272 17274 7ff7bd3c2b3e 17265->17274 17279 7ff7bd3c2b43 17265->17279 17270 7ff7bd3c2a75 17266->17270 17271 7ff7bd3c2aa4 17266->17271 17276 7ff7bd3c0364 38 API calls 17267->17276 17270->17272 17271->17279 17274->17267 17274->17279 17350 7ff7bd3bf5d8 17294->17350 17314 7ff7bd3c0397 17313->17314 17315 7ff7bd3c03c6 17314->17315 17317 7ff7bd3c0483 17314->17317 17321 7ff7bd3bff87 17320->17321 17328 7ff7bd3c3773 17327->17328 17332 7ff7bd3c07a7 17331->17332 17351 7ff7bd3bf61f 17350->17351 17352 7ff7bd3bf60d 17350->17352 17355 7ff7bd3bf62d 17351->17355 17359 7ff7bd3bf669 17351->17359 17353 7ff7bd3c6098 _get_daylight 11 API calls 17352->17353 17354 7ff7bd3bf612 17353->17354 17356 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 17354->17356 17357 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 17355->17357 17364 7ff7bd3bf61d 17356->17364 17357->17364 17358 7ff7bd3bf9e5 17360 7ff7bd3c6098 _get_daylight 11 API calls 17358->17360 17358->17364 17359->17358 17361 7ff7bd3c6098 _get_daylight 11 API calls 17359->17361 17363 7ff7bd3bf9da 17361->17363 17364->17220 17408 7ff7bd3d0728 17367->17408 17467 7ff7bd3d04a0 17408->17467 17498 7ff7bd3c60d6 17497->17498 17501 7ff7bd3c6109 17497->17501 17499 7ff7bd3cf9b4 _wfindfirst32i64 37 API calls 17498->17499 17498->17501 17500 7ff7bd3c6105 17499->17500 17500->17501 17501->17179 17505 7ff7bd3c5452 17504->17505 17506 7ff7bd3c53e4 17504->17506 17541 7ff7bd3cf120 17505->17541 17506->17505 17508 7ff7bd3c53e9 17506->17508 17544 7ff7bd3cef30 17541->17544 17605 7ff7bd3ca790 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17604->17605 17607 7ff7bd3c517d 17605->17607 17606 7ff7bd3cef27 17613 7ff7bd3ba2a4 17606->17613 17607->17606 17610 7ff7bd3cee46 17607->17610 17611 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17610->17611 17612 7ff7bd3cef1f 17611->17612 17612->17060 17616 7ff7bd3ba2b8 IsProcessorFeaturePresent 17613->17616 17617 7ff7bd3ba2cf 17616->17617 17622 7ff7bd3ba354 RtlCaptureContext RtlLookupFunctionEntry 17617->17622 17623 7ff7bd3ba2e3 17622->17623 17624 7ff7bd3ba384 RtlVirtualUnwind 17622->17624 17625 7ff7bd3ba190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17623->17625 17624->17623 17627 7ff7bd3bee1c 17626->17627 17632 7ff7bd3bee49 17626->17632 17628 7ff7bd3bee51 17627->17628 17629 7ff7bd3bee26 17627->17629 17627->17632 17632->17094 17642 7ff7bd3b2264 17641->17642 17643 7ff7bd3c3c90 49 API calls 17642->17643 17644 7ff7bd3b228a 17643->17644 17645 7ff7bd3b229b 17644->17645 17673 7ff7bd3c4e80 17644->17673 17647 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17645->17647 17648 7ff7bd3b1ebd 17647->17648 17648->16988 17648->16989 17650 7ff7bd3b576e 17649->17650 17651 7ff7bd3b2de0 120 API calls 17650->17651 17652 7ff7bd3b5795 17651->17652 17653 7ff7bd3b5ba0 138 API calls 17652->17653 17654 7ff7bd3b57a3 17653->17654 17674 7ff7bd3c4ea9 17673->17674 17675 7ff7bd3c4e9d 17673->17675 17677 7ff7bd3c4a94 45 API calls 17674->17677 17690 7ff7bd3c46f8 17675->17690 17678 7ff7bd3c4ed1 17677->17678 17679 7ff7bd3ce154 5 API calls 17678->17679 17680 7ff7bd3c4ee1 17678->17680 17679->17680 17681 7ff7bd3c457c 14 API calls 17680->17681 17682 7ff7bd3c4f39 17681->17682 17683 7ff7bd3c4f51 17682->17683 17684 7ff7bd3c4f3d 17682->17684 17686 7ff7bd3c46f8 69 API calls 17683->17686 17685 7ff7bd3c4ea2 17684->17685 17688 7ff7bd3c9f88 __free_lconv_num 11 API calls 17684->17688 17685->17645 17687 7ff7bd3c4f5d 17686->17687 17687->17685 17689 7ff7bd3c9f88 __free_lconv_num 11 API calls 17687->17689 17688->17685 17689->17685 17691 7ff7bd3c4712 17690->17691 17692 7ff7bd3c472f 17690->17692 17694 7ff7bd3c6078 _fread_nolock 11 API calls 17691->17694 17692->17691 17693 7ff7bd3c4742 CreateFileW 17692->17693 17695 7ff7bd3c4776 17693->17695 17696 7ff7bd3c47ac 17693->17696 17697 7ff7bd3c4717 17694->17697 17715 7ff7bd3c484c GetFileType 17695->17715 17741 7ff7bd3c4d70 17696->17741 17700 7ff7bd3c6098 _get_daylight 11 API calls 17697->17700 17703 7ff7bd3c471f 17700->17703 17708 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 17703->17708 17704 7ff7bd3c47a1 CloseHandle 17710 7ff7bd3c472a 17704->17710 17705 7ff7bd3c478b CloseHandle 17705->17710 17706 7ff7bd3c47e0 17762 7ff7bd3c4b30 17706->17762 17707 7ff7bd3c47b5 17711 7ff7bd3c600c _fread_nolock 11 API calls 17707->17711 17708->17710 17710->17685 17716 7ff7bd3c489a 17715->17716 17717 7ff7bd3c4957 17715->17717 17720 7ff7bd3c48c6 GetFileInformationByHandle 17716->17720 17725 7ff7bd3c4c6c 21 API calls 17716->17725 17718 7ff7bd3c4981 17717->17718 17719 7ff7bd3c495f 17717->17719 17724 7ff7bd3c49a4 PeekNamedPipe 17718->17724 17730 7ff7bd3c4942 17718->17730 17721 7ff7bd3c4972 GetLastError 17719->17721 17722 7ff7bd3c4963 17719->17722 17720->17721 17723 7ff7bd3c48ef 17720->17723 17728 7ff7bd3c600c _fread_nolock 11 API calls 17721->17728 17726 7ff7bd3c6098 _get_daylight 11 API calls 17722->17726 17727 7ff7bd3c4b30 51 API calls 17723->17727 17724->17730 17729 7ff7bd3c48b4 17725->17729 17726->17730 17731 7ff7bd3c48fa 17727->17731 17728->17730 17729->17720 17729->17730 17732 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17730->17732 17779 7ff7bd3c49f4 17731->17779 17734 7ff7bd3c4784 17732->17734 17734->17704 17734->17705 17742 7ff7bd3c4da6 17741->17742 17743 7ff7bd3c4e3e __std_exception_copy 17742->17743 17744 7ff7bd3c6098 _get_daylight 11 API calls 17742->17744 17745 7ff7bd3ba110 _wfindfirst32i64 8 API calls 17743->17745 17746 7ff7bd3c4db8 17744->17746 17747 7ff7bd3c47b1 17745->17747 17748 7ff7bd3c6098 _get_daylight 11 API calls 17746->17748 17747->17706 17747->17707 17749 7ff7bd3c4dc0 17748->17749 17750 7ff7bd3c53c8 45 API calls 17749->17750 17830 7ff7bd3b61ea 17829->17830 17831 7ff7bd3c92fd 17829->17831 17835 7ff7bd3c706c 17830->17835 17832 7ff7bd3c6098 _get_daylight 11 API calls 17831->17832 17833 7ff7bd3c9302 17832->17833 17834 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 17833->17834 17834->17830 17836 7ff7bd3c7075 17835->17836 17837 7ff7bd3c708a 17835->17837 17838 7ff7bd3c6078 _fread_nolock 11 API calls 17836->17838 17839 7ff7bd3c6078 _fread_nolock 11 API calls 17837->17839 17845 7ff7bd3c7082 17837->17845 17886 7ff7bd3c547c 17885->17886 17887 7ff7bd3c54a2 17886->17887 17890 7ff7bd3c54d5 17886->17890 17888 7ff7bd3c6098 _get_daylight 11 API calls 17887->17888 17889 7ff7bd3c54a7 17888->17889 17891 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 17889->17891 17892 7ff7bd3c54e8 17890->17892 17893 7ff7bd3c54db 17890->17893 17895 7ff7bd3b2e39 17891->17895 17904 7ff7bd3ca268 17892->17904 17896 7ff7bd3c6098 _get_daylight 11 API calls 17893->17896 17895->16411 17896->17895 17917 7ff7bd3cf818 EnterCriticalSection 17904->17917 18265 7ff7bd3c7adc 18264->18265 18268 7ff7bd3c75b8 18265->18268 18267 7ff7bd3c7af5 18267->16421 18269 7ff7bd3c7602 18268->18269 18270 7ff7bd3c75d3 18268->18270 18278 7ff7bd3c439c EnterCriticalSection 18269->18278 18271 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 18270->18271 18277 7ff7bd3c75f3 18271->18277 18277->18267 18280 7ff7bd3be441 18279->18280 18281 7ff7bd3be413 18279->18281 18288 7ff7bd3be433 18280->18288 18289 7ff7bd3c439c EnterCriticalSection 18280->18289 18282 7ff7bd3c9e54 _invalid_parameter_noinfo 37 API calls 18281->18282 18282->18288 18288->16425 18291 7ff7bd3b12c6 18290->18291 18292 7ff7bd3b12f8 18290->18292 18293 7ff7bd3b2de0 120 API calls 18291->18293 18294 7ff7bd3beca4 73 API calls 18292->18294 18295 7ff7bd3b12d6 18293->18295 18296 7ff7bd3b130a 18294->18296 18295->18292 18297 7ff7bd3b12de 18295->18297 18298 7ff7bd3b132f 18296->18298 18299 7ff7bd3b130e 18296->18299 18300 7ff7bd3b1c50 86 API calls 18297->18300 18304 7ff7bd3b1364 18298->18304 18305 7ff7bd3b1344 18298->18305 18301 7ff7bd3b1c10 86 API calls 18299->18301 18302 7ff7bd3b12ee 18300->18302 18303 7ff7bd3b1325 18301->18303 18302->16450 18303->16450 18307 7ff7bd3b137e 18304->18307 18312 7ff7bd3b1395 18304->18312 18306 7ff7bd3b1c10 86 API calls 18305->18306 18313 7ff7bd3b135f __std_exception_copy 18306->18313 18308 7ff7bd3b1050 94 API calls 18307->18308 18308->18313 18309 7ff7bd3b1421 18309->16450 18310 7ff7bd3be96c _fread_nolock 53 API calls 18310->18312 18311 7ff7bd3be61c 74 API calls 18311->18309 18312->18310 18312->18313 18314 7ff7bd3b13de 18312->18314 18313->18309 18313->18311 18315 7ff7bd3b1c10 86 API calls 18314->18315 18315->18313 18317 7ff7bd3b1b30 49 API calls 18316->18317 18318 7ff7bd3b2e90 18317->18318 18318->16452 18320 7ff7bd3b1669 18319->18320 18321 7ff7bd3b16ab 18319->18321 18320->18321 18322 7ff7bd3b1c50 86 API calls 18320->18322 18321->16460 18323 7ff7bd3b16bf 18322->18323 18323->16460 18325 7ff7bd3b6dc0 88 API calls 18324->18325 18326 7ff7bd3b6337 LoadLibraryExW 18325->18326 18327 7ff7bd3b6354 __std_exception_copy 18326->18327 18327->16476 18329 7ff7bd3b50d9 18328->18329 18330 7ff7bd3b50fc GetProcAddress 18328->18330 18333 7ff7bd3b1cb0 86 API calls 18329->18333 18330->18329 18331 7ff7bd3b5121 GetProcAddress 18330->18331 18331->18329 18332 7ff7bd3b5146 GetProcAddress 18331->18332 18332->18329 18334 7ff7bd3b516e GetProcAddress 18332->18334 18335 7ff7bd3b50ec 18333->18335 18334->18329 18336 7ff7bd3b5196 GetProcAddress 18334->18336 18335->16483 18336->18329 18337 7ff7bd3b51be GetProcAddress 18336->18337 18388 7ff7bd3b3ad0 18387->18388 18389 7ff7bd3b1b30 49 API calls 18388->18389 18390 7ff7bd3b3b02 18389->18390 18391 7ff7bd3b3b2b 18390->18391 18392 7ff7bd3b3b0b 18390->18392 18393 7ff7bd3b3b82 18391->18393 18395 7ff7bd3b2e60 49 API calls 18391->18395 18394 7ff7bd3b1c50 86 API calls 18392->18394 18396 7ff7bd3b2e60 49 API calls 18393->18396 18414 7ff7bd3b3b21 18394->18414 18397 7ff7bd3b3b4c 18395->18397 18398 7ff7bd3b3b9b 18396->18398 18399 7ff7bd3b3b6a 18397->18399 18403 7ff7bd3b1c50 86 API calls 18397->18403 18401 7ff7bd3b3bb9 18398->18401 18406 7ff7bd3b1c50 86 API calls 18398->18406 18458 7ff7bd3b2d70 18399->18458 18400 7ff7bd3ba110 _wfindfirst32i64 8 API calls 18405 7ff7bd3b22de 18400->18405 18402 7ff7bd3b6320 89 API calls 18401->18402 18407 7ff7bd3b3bc6 18402->18407 18403->18399 18405->16497 18415 7ff7bd3b3e40 18405->18415 18406->18401 18409 7ff7bd3b3bed 18407->18409 18410 7ff7bd3b3bcb 18407->18410 18464 7ff7bd3b2f20 GetProcAddress 18409->18464 18411 7ff7bd3b1cb0 86 API calls 18410->18411 18411->18414 18413 7ff7bd3b6320 89 API calls 18413->18393 18414->18400 18416 7ff7bd3b5af0 92 API calls 18415->18416 18417 7ff7bd3b3e55 18416->18417 18418 7ff7bd3b3e70 18417->18418 18420 7ff7bd3b1c50 86 API calls 18417->18420 18419 7ff7bd3b6dc0 88 API calls 18418->18419 18421 7ff7bd3b3eb4 18419->18421 18420->18418 18422 7ff7bd3b3ed0 18421->18422 18423 7ff7bd3b3eb9 18421->18423 18426 7ff7bd3b6dc0 88 API calls 18422->18426 18424 7ff7bd3b1c50 86 API calls 18423->18424 18425 7ff7bd3b3ec5 18424->18425 18425->16499 18427 7ff7bd3b3f05 18426->18427 18429 7ff7bd3b1b30 49 API calls 18427->18429 18441 7ff7bd3b3f0a __std_exception_copy 18427->18441 18428 7ff7bd3b1c50 86 API calls 18430 7ff7bd3b40b1 18428->18430 18431 7ff7bd3b3f87 18429->18431 18430->16499 18432 7ff7bd3b3fb3 18431->18432 18433 7ff7bd3b3f8e 18431->18433 18435 7ff7bd3b6dc0 88 API calls 18432->18435 18434 7ff7bd3b1c50 86 API calls 18433->18434 18436 7ff7bd3b3fa3 18434->18436 18437 7ff7bd3b3fcc 18435->18437 18436->16499 18437->18441 18441->18428 18442 7ff7bd3b409a 18441->18442 18442->16499 18444 7ff7bd3b3857 18443->18444 18444->18444 18445 7ff7bd3b3880 18444->18445 18452 7ff7bd3b3897 __std_exception_copy 18444->18452 18446 7ff7bd3b1c50 86 API calls 18445->18446 18448 7ff7bd3b397b 18449 7ff7bd3b12b0 120 API calls 18449->18452 18450 7ff7bd3b1780 86 API calls 18450->18452 18451 7ff7bd3b1c50 86 API calls 18451->18452 18452->18448 18452->18449 18452->18450 18452->18451 18459 7ff7bd3b2d7a 18458->18459 18460 7ff7bd3b6dc0 88 API calls 18459->18460 18461 7ff7bd3b2da2 18460->18461 18462 7ff7bd3ba110 _wfindfirst32i64 8 API calls 18461->18462 18463 7ff7bd3b2dca 18462->18463 18463->18393 18463->18413 18465 7ff7bd3b2f48 18464->18465 18466 7ff7bd3b2f6b GetProcAddress 18464->18466 18468 7ff7bd3b1cb0 86 API calls 18465->18468 18466->18465 18467 7ff7bd3b2f90 GetProcAddress 18466->18467 18467->18465 18469 7ff7bd3b2fb5 GetProcAddress 18467->18469 18470 7ff7bd3b2f5b 18468->18470 18469->18465 18471 7ff7bd3b2fdd GetProcAddress 18469->18471 18470->18414 18471->18465 18472 7ff7bd3b3005 GetProcAddress 18471->18472 18472->18465 18473 7ff7bd3b302d GetProcAddress 18472->18473 18474 7ff7bd3b3055 GetProcAddress 18473->18474 18475 7ff7bd3b3049 18473->18475 18476 7ff7bd3b3071 18474->18476 18477 7ff7bd3b307d GetProcAddress 18474->18477 18475->18474 18476->18477 18478 7ff7bd3b3099 18477->18478 18479 7ff7bd3b30d5 GetProcAddress 18478->18479 18480 7ff7bd3b30ad GetProcAddress 18478->18480 18480->18479 18684 7ff7bd3ca790 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18683->18684 18685 7ff7bd3c9251 18684->18685 18686 7ff7bd3c937c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18685->18686 18687 7ff7bd3c9271 18686->18687 18688 7ff7bd3c8929 18689 7ff7bd3c9248 45 API calls 18688->18689 18690 7ff7bd3c892e 18689->18690 18691 7ff7bd3c8955 GetModuleHandleW 18690->18691 18692 7ff7bd3c899f 18690->18692 18691->18692 18698 7ff7bd3c8962 18691->18698 18700 7ff7bd3c882c 18692->18700 18698->18692 18714 7ff7bd3c8a50 GetModuleHandleExW 18698->18714 18720 7ff7bd3cf818 EnterCriticalSection 18700->18720 18715 7ff7bd3c8a84 GetProcAddress 18714->18715 18716 7ff7bd3c8aad 18714->18716 18717 7ff7bd3c8a96 18715->18717 18718 7ff7bd3c8ab2 FreeLibrary 18716->18718 18719 7ff7bd3c8ab9 18716->18719 18717->18716 18718->18719 18719->18692 18928 7ff7bd3ba440 18929 7ff7bd3ba450 18928->18929 18945 7ff7bd3c581c 18929->18945 18931 7ff7bd3ba45c 18951 7ff7bd3ba758 18931->18951 18933 7ff7bd3baa3c 7 API calls 18936 7ff7bd3ba4f5 18933->18936 18934 7ff7bd3ba474 _RTC_Initialize 18943 7ff7bd3ba4c9 18934->18943 18956 7ff7bd3ba908 18934->18956 18937 7ff7bd3ba489 18959 7ff7bd3c7fe0 18937->18959 18943->18933 18944 7ff7bd3ba4e5 18943->18944 18946 7ff7bd3c582d 18945->18946 18947 7ff7bd3c5835 18946->18947 18948 7ff7bd3c6098 _get_daylight 11 API calls 18946->18948 18947->18931 18949 7ff7bd3c5844 18948->18949 18950 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 18949->18950 18950->18947 18952 7ff7bd3ba769 18951->18952 18955 7ff7bd3ba76e __scrt_acquire_startup_lock 18951->18955 18953 7ff7bd3baa3c 7 API calls 18952->18953 18952->18955 18954 7ff7bd3ba7e2 18953->18954 18955->18934 18984 7ff7bd3ba8cc 18956->18984 18958 7ff7bd3ba911 18958->18937 18960 7ff7bd3c8000 18959->18960 18961 7ff7bd3ba495 18959->18961 18962 7ff7bd3c8008 18960->18962 18963 7ff7bd3c801e GetModuleFileNameW 18960->18963 18961->18943 18983 7ff7bd3ba9dc InitializeSListHead 18961->18983 18964 7ff7bd3c6098 _get_daylight 11 API calls 18962->18964 18967 7ff7bd3c8049 18963->18967 18965 7ff7bd3c800d 18964->18965 18966 7ff7bd3c9f20 _invalid_parameter_noinfo 37 API calls 18965->18966 18966->18961 18968 7ff7bd3c7f80 11 API calls 18967->18968 18969 7ff7bd3c8089 18968->18969 18970 7ff7bd3c8091 18969->18970 18973 7ff7bd3c80a9 18969->18973 18971 7ff7bd3c6098 _get_daylight 11 API calls 18970->18971 18972 7ff7bd3c8096 18971->18972 18975 7ff7bd3c9f88 __free_lconv_num 11 API calls 18972->18975 18974 7ff7bd3c80cb 18973->18974 18977 7ff7bd3c8110 18973->18977 18978 7ff7bd3c80f7 18973->18978 18976 7ff7bd3c9f88 __free_lconv_num 11 API calls 18974->18976 18975->18961 18976->18961 18980 7ff7bd3c9f88 __free_lconv_num 11 API calls 18977->18980 18979 7ff7bd3c9f88 __free_lconv_num 11 API calls 18978->18979 18981 7ff7bd3c8100 18979->18981 18980->18974 18982 7ff7bd3c9f88 __free_lconv_num 11 API calls 18981->18982 18982->18961 18985 7ff7bd3ba8e6 18984->18985 18987 7ff7bd3ba8df 18984->18987 18988 7ff7bd3c905c 18985->18988 18987->18958 18991 7ff7bd3c8c98 18988->18991 18998 7ff7bd3cf818 EnterCriticalSection 18991->18998 18999 7ff7bd3c4340 19000 7ff7bd3c434b 18999->19000 19008 7ff7bd3ce4d4 19000->19008 19021 7ff7bd3cf818 EnterCriticalSection 19008->19021 19349 7ff7bd3c8bc0 19352 7ff7bd3c8b40 19349->19352 19359 7ff7bd3cf818 EnterCriticalSection 19352->19359

                                                                              Executed Functions

                                                                              Function 00007FF7BD3D4EB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 135 7ff7bd3d4eb0-7ff7bd3d4eeb call 7ff7bd3d4838 call 7ff7bd3d4840 call 7ff7bd3d48a8 142 7ff7bd3d5115-7ff7bd3d5161 call 7ff7bd3c9f40 call 7ff7bd3d4838 call 7ff7bd3d4840 call 7ff7bd3d48a8 135->142 143 7ff7bd3d4ef1-7ff7bd3d4efc call 7ff7bd3d4848 135->143 169 7ff7bd3d529f-7ff7bd3d530d call 7ff7bd3c9f40 call 7ff7bd3d0748 142->169 170 7ff7bd3d5167-7ff7bd3d5172 call 7ff7bd3d4848 142->170 143->142 148 7ff7bd3d4f02-7ff7bd3d4f0c 143->148 151 7ff7bd3d4f2e-7ff7bd3d4f32 148->151 152 7ff7bd3d4f0e-7ff7bd3d4f11 148->152 153 7ff7bd3d4f35-7ff7bd3d4f3d 151->153 155 7ff7bd3d4f14-7ff7bd3d4f1f 152->155 153->153 156 7ff7bd3d4f3f-7ff7bd3d4f52 call 7ff7bd3ccc3c 153->156 158 7ff7bd3d4f21-7ff7bd3d4f28 155->158 159 7ff7bd3d4f2a-7ff7bd3d4f2c 155->159 165 7ff7bd3d4f54-7ff7bd3d4f56 call 7ff7bd3c9f88 156->165 166 7ff7bd3d4f6a-7ff7bd3d4f76 call 7ff7bd3c9f88 156->166 158->155 158->159 159->151 162 7ff7bd3d4f5b-7ff7bd3d4f69 159->162 165->162 176 7ff7bd3d4f7d-7ff7bd3d4f85 166->176 187 7ff7bd3d530f-7ff7bd3d5316 169->187 188 7ff7bd3d531b-7ff7bd3d531e 169->188 170->169 178 7ff7bd3d5178-7ff7bd3d5183 call 7ff7bd3d4878 170->178 176->176 179 7ff7bd3d4f87-7ff7bd3d4f98 call 7ff7bd3cf9b4 176->179 178->169 189 7ff7bd3d5189-7ff7bd3d51ac call 7ff7bd3c9f88 GetTimeZoneInformation 178->189 179->142 190 7ff7bd3d4f9e-7ff7bd3d4ff4 call 7ff7bd3bb890 * 4 call 7ff7bd3d4dcc 179->190 191 7ff7bd3d53ab-7ff7bd3d53ae 187->191 192 7ff7bd3d5355-7ff7bd3d5368 call 7ff7bd3ccc3c 188->192 193 7ff7bd3d5320 188->193 206 7ff7bd3d5274-7ff7bd3d529e call 7ff7bd3d4830 call 7ff7bd3d4820 call 7ff7bd3d4828 189->206 207 7ff7bd3d51b2-7ff7bd3d51d3 189->207 247 7ff7bd3d4ff6-7ff7bd3d4ffa 190->247 198 7ff7bd3d5323 191->198 199 7ff7bd3d53b4-7ff7bd3d53bc call 7ff7bd3d4eb0 191->199 213 7ff7bd3d5373-7ff7bd3d538e call 7ff7bd3d0748 192->213 214 7ff7bd3d536a 192->214 193->198 204 7ff7bd3d5328-7ff7bd3d5354 call 7ff7bd3c9f88 call 7ff7bd3ba110 198->204 205 7ff7bd3d5323 call 7ff7bd3d512c 198->205 199->204 205->204 208 7ff7bd3d51d5-7ff7bd3d51db 207->208 209 7ff7bd3d51de-7ff7bd3d51e5 207->209 208->209 216 7ff7bd3d51e7-7ff7bd3d51ef 209->216 217 7ff7bd3d51f9 209->217 235 7ff7bd3d5395-7ff7bd3d53a7 call 7ff7bd3c9f88 213->235 236 7ff7bd3d5390-7ff7bd3d5393 213->236 221 7ff7bd3d536c-7ff7bd3d5371 call 7ff7bd3c9f88 214->221 216->217 223 7ff7bd3d51f1-7ff7bd3d51f7 216->223 226 7ff7bd3d51fb-7ff7bd3d526f call 7ff7bd3bb890 * 4 call 7ff7bd3d1d0c call 7ff7bd3d53c4 * 2 217->226 221->193 223->226 226->206 235->191 236->221 249 7ff7bd3d5000-7ff7bd3d5004 247->249 250 7ff7bd3d4ffc 247->250 249->247 252 7ff7bd3d5006-7ff7bd3d502b call 7ff7bd3d7cf4 249->252 250->249 258 7ff7bd3d502e-7ff7bd3d5032 252->258 260 7ff7bd3d5034-7ff7bd3d503f 258->260 261 7ff7bd3d5041-7ff7bd3d5045 258->261 260->261 263 7ff7bd3d5047-7ff7bd3d504b 260->263 261->258 266 7ff7bd3d50cc-7ff7bd3d50d0 263->266 267 7ff7bd3d504d-7ff7bd3d5075 call 7ff7bd3d7cf4 263->267 268 7ff7bd3d50d2-7ff7bd3d50d4 266->268 269 7ff7bd3d50d7-7ff7bd3d50e4 266->269 275 7ff7bd3d5093-7ff7bd3d5097 267->275 276 7ff7bd3d5077 267->276 268->269 271 7ff7bd3d50e6-7ff7bd3d50fc call 7ff7bd3d4dcc 269->271 272 7ff7bd3d50ff-7ff7bd3d510e call 7ff7bd3d4830 call 7ff7bd3d4820 269->272 271->272 272->142 275->266 281 7ff7bd3d5099-7ff7bd3d50b7 call 7ff7bd3d7cf4 275->281 279 7ff7bd3d507a-7ff7bd3d5081 276->279 279->275 282 7ff7bd3d5083-7ff7bd3d5091 279->282 287 7ff7bd3d50c3-7ff7bd3d50ca 281->287 282->275 282->279 287->266 288 7ff7bd3d50b9-7ff7bd3d50bd 287->288 288->266 289 7ff7bd3d50bf 288->289 289->287
                                                                              APIs
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D4EF5
                                                                                • Part of subcall function 00007FF7BD3D4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D485C
                                                                                • Part of subcall function 00007FF7BD3C9F88: RtlFreeHeap.NTDLL(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                                • Part of subcall function 00007FF7BD3C9F40: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7BD3C9F1F,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3C9F49
                                                                                • Part of subcall function 00007FF7BD3C9F40: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7BD3C9F1F,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3C9F6E
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D4EE4
                                                                                • Part of subcall function 00007FF7BD3D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D48BC
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D515A
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D516B
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D517C
                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7BD3D53BC), ref: 00007FF7BD3D51A3
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                              • API String ID: 4070488512-239921721
                                                                              • Opcode ID: 094aa0b8d65919baa3d0772ff3767fd2675aa8a4e03dc9ca21af0ffdcdca806f
                                                                              • Instruction ID: 76071ce308c92680174e936acf4efdca744feb708df7ca26c9ca378d5590d59f
                                                                              • Opcode Fuzzy Hash: 094aa0b8d65919baa3d0772ff3767fd2675aa8a4e03dc9ca21af0ffdcdca806f
                                                                              • Instruction Fuzzy Hash: 04D19026E0C242C6EB68BF29D4601B9E751EB66784F844139EB4D4769FFF3CE4418B60
                                                                              Function 00007FF7BD3B58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              • GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B5977
                                                                              • GetCurrentProcessId.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B597D
                                                                                • Part of subcall function 00007FF7BD3B5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7BD3B2817,?,?,?,?,?,?), ref: 00007FF7BD3B5B2A
                                                                                • Part of subcall function 00007FF7BD3B5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B5B47
                                                                                • Part of subcall function 00007FF7BD3C6828: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3C6841
                                                                              • SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B5A31
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                              • API String ID: 1556224225-1116378104
                                                                              • Opcode ID: c37227a989606194a9b775c0e79d879d36e5a46f9a7ba2449f26b34a68ac7e0c
                                                                              • Instruction ID: 2879302f61b62613c469c61e037d04f7869bf1581f5f94fbf05ca48e661793fe
                                                                              • Opcode Fuzzy Hash: c37227a989606194a9b775c0e79d879d36e5a46f9a7ba2449f26b34a68ac7e0c
                                                                              • Instruction Fuzzy Hash: 1A516E11B1D65381FA9DB72AA8512B9E6515F6BBC0FC85038EF0E5B69BFD2CE4018720
                                                                              Function 00007FF7BD3D5DFC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 389 7ff7bd3d5dfc-7ff7bd3d5e6f call 7ff7bd3d5b30 392 7ff7bd3d5e71-7ff7bd3d5e7a call 7ff7bd3c6078 389->392 393 7ff7bd3d5e89-7ff7bd3d5e93 call 7ff7bd3c6e70 389->393 400 7ff7bd3d5e7d-7ff7bd3d5e84 call 7ff7bd3c6098 392->400 398 7ff7bd3d5e95-7ff7bd3d5eac call 7ff7bd3c6078 call 7ff7bd3c6098 393->398 399 7ff7bd3d5eae-7ff7bd3d5f17 CreateFileW 393->399 398->400 402 7ff7bd3d5f94-7ff7bd3d5f9f GetFileType 399->402 403 7ff7bd3d5f19-7ff7bd3d5f1f 399->403 417 7ff7bd3d61ca-7ff7bd3d61ea 400->417 409 7ff7bd3d5fa1-7ff7bd3d5fdc GetLastError call 7ff7bd3c600c CloseHandle 402->409 410 7ff7bd3d5ff2-7ff7bd3d5ff9 402->410 406 7ff7bd3d5f61-7ff7bd3d5f8f GetLastError call 7ff7bd3c600c 403->406 407 7ff7bd3d5f21-7ff7bd3d5f25 403->407 406->400 407->406 415 7ff7bd3d5f27-7ff7bd3d5f5f CreateFileW 407->415 409->400 423 7ff7bd3d5fe2-7ff7bd3d5fed call 7ff7bd3c6098 409->423 413 7ff7bd3d6001-7ff7bd3d6004 410->413 414 7ff7bd3d5ffb-7ff7bd3d5fff 410->414 420 7ff7bd3d600a-7ff7bd3d605f call 7ff7bd3c6d88 413->420 421 7ff7bd3d6006 413->421 414->420 415->402 415->406 428 7ff7bd3d6061-7ff7bd3d606d call 7ff7bd3d5d38 420->428 429 7ff7bd3d607e-7ff7bd3d60af call 7ff7bd3d58b0 420->429 421->420 423->400 428->429 436 7ff7bd3d606f 428->436 434 7ff7bd3d60b5-7ff7bd3d60f7 429->434 435 7ff7bd3d60b1-7ff7bd3d60b3 429->435 438 7ff7bd3d6119-7ff7bd3d6124 434->438 439 7ff7bd3d60f9-7ff7bd3d60fd 434->439 437 7ff7bd3d6071-7ff7bd3d6079 call 7ff7bd3ca100 435->437 436->437 437->417 442 7ff7bd3d61c8 438->442 443 7ff7bd3d612a-7ff7bd3d612e 438->443 439->438 441 7ff7bd3d60ff-7ff7bd3d6114 439->441 441->438 442->417 443->442 445 7ff7bd3d6134-7ff7bd3d6179 CloseHandle CreateFileW 443->445 446 7ff7bd3d617b-7ff7bd3d61a9 GetLastError call 7ff7bd3c600c call 7ff7bd3c6fb0 445->446 447 7ff7bd3d61ae-7ff7bd3d61c3 445->447 446->447 447->442
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                              • String ID:
                                                                              • API String ID: 1617910340-0
                                                                              • Opcode ID: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                                                              • Instruction ID: 828f3d3319de8c9f82800a809c0269d92b7a49632210904c2268358630a2ba04
                                                                              • Opcode Fuzzy Hash: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                                                              • Instruction Fuzzy Hash: B0C1F433B1CA45C5EB14EF68C4901ACBB61F76AB98B450239DB2E573AAEF38D055C710
                                                                              Function 00007FF7BD3D512C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 794 7ff7bd3d512c-7ff7bd3d5161 call 7ff7bd3d4838 call 7ff7bd3d4840 call 7ff7bd3d48a8 801 7ff7bd3d529f-7ff7bd3d530d call 7ff7bd3c9f40 call 7ff7bd3d0748 794->801 802 7ff7bd3d5167-7ff7bd3d5172 call 7ff7bd3d4848 794->802 813 7ff7bd3d530f-7ff7bd3d5316 801->813 814 7ff7bd3d531b-7ff7bd3d531e 801->814 802->801 807 7ff7bd3d5178-7ff7bd3d5183 call 7ff7bd3d4878 802->807 807->801 815 7ff7bd3d5189-7ff7bd3d51ac call 7ff7bd3c9f88 GetTimeZoneInformation 807->815 816 7ff7bd3d53ab-7ff7bd3d53ae 813->816 817 7ff7bd3d5355-7ff7bd3d5368 call 7ff7bd3ccc3c 814->817 818 7ff7bd3d5320 814->818 828 7ff7bd3d5274-7ff7bd3d529e call 7ff7bd3d4830 call 7ff7bd3d4820 call 7ff7bd3d4828 815->828 829 7ff7bd3d51b2-7ff7bd3d51d3 815->829 821 7ff7bd3d5323 816->821 822 7ff7bd3d53b4-7ff7bd3d53bc call 7ff7bd3d4eb0 816->822 834 7ff7bd3d5373-7ff7bd3d538e call 7ff7bd3d0748 817->834 835 7ff7bd3d536a 817->835 818->821 826 7ff7bd3d5328-7ff7bd3d5354 call 7ff7bd3c9f88 call 7ff7bd3ba110 821->826 827 7ff7bd3d5323 call 7ff7bd3d512c 821->827 822->826 827->826 830 7ff7bd3d51d5-7ff7bd3d51db 829->830 831 7ff7bd3d51de-7ff7bd3d51e5 829->831 830->831 837 7ff7bd3d51e7-7ff7bd3d51ef 831->837 838 7ff7bd3d51f9 831->838 853 7ff7bd3d5395-7ff7bd3d53a7 call 7ff7bd3c9f88 834->853 854 7ff7bd3d5390-7ff7bd3d5393 834->854 841 7ff7bd3d536c-7ff7bd3d5371 call 7ff7bd3c9f88 835->841 837->838 843 7ff7bd3d51f1-7ff7bd3d51f7 837->843 845 7ff7bd3d51fb-7ff7bd3d526f call 7ff7bd3bb890 * 4 call 7ff7bd3d1d0c call 7ff7bd3d53c4 * 2 838->845 841->818 843->845 845->828 853->816 854->841
                                                                              APIs
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D515A
                                                                                • Part of subcall function 00007FF7BD3D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D48BC
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D516B
                                                                                • Part of subcall function 00007FF7BD3D4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D485C
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D517C
                                                                                • Part of subcall function 00007FF7BD3D4878: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D488C
                                                                                • Part of subcall function 00007FF7BD3C9F88: RtlFreeHeap.NTDLL(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7BD3D53BC), ref: 00007FF7BD3D51A3
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                              • API String ID: 3458911817-239921721
                                                                              • Opcode ID: fd078edb7ea8857bbddca5cb379a768099f63ff1987e7d86fa41c3a02db3c977
                                                                              • Instruction ID: 01b8db909708d385df8fc9d698bb0496eb16ee311fbb955f6a634f2448fb0fc3
                                                                              • Opcode Fuzzy Hash: fd078edb7ea8857bbddca5cb379a768099f63ff1987e7d86fa41c3a02db3c977
                                                                              • Instruction Fuzzy Hash: 24517622A0C642C6E758FF29E5901A9E750BB6A784FC4513DEB4D4369BEF3CE4008B60
                                                                              Function 00007FF7BD3CFA98 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                              • String ID:
                                                                              • API String ID: 1010374628-0
                                                                              • Opcode ID: 77b634f070b5d0425022c69dd6fb332ff82a5336b27442bcf42cac2e1250e46a
                                                                              • Instruction ID: ecf1ee5935456352ae56c2746130978a38331d83d5c177743cb59a8de8218ad7
                                                                              • Opcode Fuzzy Hash: 77b634f070b5d0425022c69dd6fb332ff82a5336b27442bcf42cac2e1250e46a
                                                                              • Instruction Fuzzy Hash: 79024C22A0E746C0EA59BB2994502B9E680AF63B90FDD453DDB5D473DBFE3DA4018320
                                                                              Function 00007FF7BD3B17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                              • API String ID: 3405171723-4158440160
                                                                              • Opcode ID: f9899f3dab2afdea0400dc1ca05c52481182e316f861a99ca011915560981afd
                                                                              • Instruction ID: b4bbd77f65c9b53a4da38963feb11938de0c1edaa2a4bb0781954b7bf57c4a3f
                                                                              • Opcode Fuzzy Hash: f9899f3dab2afdea0400dc1ca05c52481182e316f861a99ca011915560981afd
                                                                              • Instruction Fuzzy Hash: 45515E71A1DA46C6EB58EF2CD450278F3A0EB6AB44B904139EB0D8739EEE3CE540C750
                                                                              Function 00007FF7BD3B1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 53 7ff7bd3b1440-7ff7bd3b1457 call 7ff7bd3b5880 56 7ff7bd3b1462-7ff7bd3b1485 call 7ff7bd3b5ba0 53->56 57 7ff7bd3b1459-7ff7bd3b1461 53->57 60 7ff7bd3b14a7-7ff7bd3b14ad 56->60 61 7ff7bd3b1487-7ff7bd3b14a2 call 7ff7bd3b1c10 56->61 62 7ff7bd3b14af-7ff7bd3b14ba call 7ff7bd3b2de0 60->62 63 7ff7bd3b14e0-7ff7bd3b14f4 call 7ff7bd3beca4 60->63 68 7ff7bd3b1635-7ff7bd3b1647 61->68 69 7ff7bd3b14bf-7ff7bd3b14c5 62->69 72 7ff7bd3b1516-7ff7bd3b151a 63->72 73 7ff7bd3b14f6-7ff7bd3b1511 call 7ff7bd3b1c10 63->73 69->63 71 7ff7bd3b14c7-7ff7bd3b14db call 7ff7bd3b1c50 69->71 84 7ff7bd3b1617-7ff7bd3b161d 71->84 76 7ff7bd3b1534-7ff7bd3b1554 call 7ff7bd3c415c 72->76 77 7ff7bd3b151c-7ff7bd3b1528 call 7ff7bd3b1050 72->77 73->84 85 7ff7bd3b1575-7ff7bd3b157b 76->85 86 7ff7bd3b1556-7ff7bd3b1570 call 7ff7bd3b1c10 76->86 82 7ff7bd3b152d-7ff7bd3b152f 77->82 82->84 87 7ff7bd3b161f call 7ff7bd3be61c 84->87 88 7ff7bd3b162b-7ff7bd3b162e call 7ff7bd3be61c 84->88 91 7ff7bd3b1581-7ff7bd3b1586 85->91 92 7ff7bd3b1605-7ff7bd3b1608 call 7ff7bd3c4148 85->92 99 7ff7bd3b160d-7ff7bd3b1612 86->99 98 7ff7bd3b1624 87->98 94 7ff7bd3b1633 88->94 97 7ff7bd3b1590-7ff7bd3b15b2 call 7ff7bd3be96c 91->97 92->99 94->68 102 7ff7bd3b15e5-7ff7bd3b15ec 97->102 103 7ff7bd3b15b4-7ff7bd3b15cc call 7ff7bd3bf0ac 97->103 98->88 99->84 104 7ff7bd3b15f3-7ff7bd3b15fb call 7ff7bd3b1c10 102->104 108 7ff7bd3b15d5-7ff7bd3b15e3 103->108 109 7ff7bd3b15ce-7ff7bd3b15d1 103->109 112 7ff7bd3b1600 104->112 108->104 109->97 111 7ff7bd3b15d3 109->111 111->112 112->92
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                              • API String ID: 0-666925554
                                                                              • Opcode ID: 7e2a2c0b0f0d064d10a2880fe4117471e88475fb40869babe68c62c10a2f5a98
                                                                              • Instruction ID: 73c0713862583da631b8ef7b2cf8468f5049d922c0cbeb58ca2b56963aed74c1
                                                                              • Opcode Fuzzy Hash: 7e2a2c0b0f0d064d10a2880fe4117471e88475fb40869babe68c62c10a2f5a98
                                                                              • Instruction Fuzzy Hash: 67519921B0C642C5EA18BB19A5507B9F360AF62BD4F840539EF1D476AFFE3CE1448720
                                                                              Function 00007FF7BD3B6A70 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              • GetCurrentProcess.KERNEL32(00000000,00007FF7BD3B59BA,?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AB0
                                                                              • OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AC1
                                                                              • GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AE3
                                                                              • GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AED
                                                                              • GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B2A
                                                                              • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7BD3B6B3C
                                                                              • CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B54
                                                                              • LocalFree.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B86
                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7BD3B6BAD
                                                                              • CreateDirectoryW.KERNELBASE(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6BBE
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                              • API String ID: 4998090-2855260032
                                                                              • Opcode ID: 8db0a8c5664a071b86435850a3cc39cf0dbbe99956597f5d8ba641213cd3919b
                                                                              • Instruction ID: 1ba6a531c45c0faab4739f53c9146d181aeec1f70e831a4f5c9d2ee29371cca4
                                                                              • Opcode Fuzzy Hash: 8db0a8c5664a071b86435850a3cc39cf0dbbe99956597f5d8ba641213cd3919b
                                                                              • Instruction Fuzzy Hash: CE41913160C642C2E654EF19E4502AAF361FBA6790F840239FB5E476AAEF7CD448CB10
                                                                              Function 00007FF7BD3B6140 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                              • API String ID: 2895956056-3524285272
                                                                              • Opcode ID: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                                                              • Instruction ID: 9d114a1be8cab9415e207323e7e19a21b95f1a9e75d2d632595eaa1dba65ec20
                                                                              • Opcode Fuzzy Hash: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                                                              • Instruction Fuzzy Hash: 8A410571A0C782C1DA24AB68F4552AAF364FBA5360F900739E7AD477DAEF7CD0548B10
                                                                              Function 00007FF7BD3B1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 452 7ff7bd3b1000-7ff7bd3b27b6 call 7ff7bd3be3f0 call 7ff7bd3be3e8 call 7ff7bd3b67d0 call 7ff7bd3ba140 call 7ff7bd3c4320 call 7ff7bd3c4f8c call 7ff7bd3b1af0 468 7ff7bd3b28ca 452->468 469 7ff7bd3b27bc-7ff7bd3b27cb call 7ff7bd3b2cd0 452->469 470 7ff7bd3b28cf-7ff7bd3b28ef call 7ff7bd3ba110 468->470 469->468 475 7ff7bd3b27d1-7ff7bd3b27e4 call 7ff7bd3b2ba0 469->475 475->468 478 7ff7bd3b27ea-7ff7bd3b27fd call 7ff7bd3b2c50 475->478 478->468 481 7ff7bd3b2803-7ff7bd3b282a call 7ff7bd3b5af0 478->481 484 7ff7bd3b286c-7ff7bd3b2894 call 7ff7bd3b6100 call 7ff7bd3b19d0 481->484 485 7ff7bd3b282c-7ff7bd3b283b call 7ff7bd3b5af0 481->485 496 7ff7bd3b289a-7ff7bd3b28b0 call 7ff7bd3b19d0 484->496 497 7ff7bd3b297d-7ff7bd3b298e 484->497 485->484 490 7ff7bd3b283d-7ff7bd3b2843 485->490 492 7ff7bd3b284f-7ff7bd3b2869 call 7ff7bd3c4148 call 7ff7bd3b6100 490->492 493 7ff7bd3b2845-7ff7bd3b284d 490->493 492->484 493->492 506 7ff7bd3b28b2-7ff7bd3b28c5 call 7ff7bd3b1c50 496->506 507 7ff7bd3b28f0-7ff7bd3b28f3 496->507 500 7ff7bd3b2990-7ff7bd3b299a call 7ff7bd3b24a0 497->500 501 7ff7bd3b29a3-7ff7bd3b29bb call 7ff7bd3b6dc0 497->501 513 7ff7bd3b29db-7ff7bd3b29e8 call 7ff7bd3b4fa0 500->513 514 7ff7bd3b299c 500->514 515 7ff7bd3b29bd-7ff7bd3b29c9 call 7ff7bd3b1c50 501->515 516 7ff7bd3b29ce-7ff7bd3b29d5 SetDllDirectoryW 501->516 506->468 507->497 512 7ff7bd3b28f9-7ff7bd3b2910 call 7ff7bd3b2de0 507->512 525 7ff7bd3b2912-7ff7bd3b2915 512->525 526 7ff7bd3b2917-7ff7bd3b2943 call 7ff7bd3b6370 512->526 523 7ff7bd3b2a36-7ff7bd3b2a3b call 7ff7bd3b4f20 513->523 524 7ff7bd3b29ea-7ff7bd3b29fa call 7ff7bd3b4c40 513->524 514->501 515->468 516->513 532 7ff7bd3b2a40-7ff7bd3b2a43 523->532 524->523 540 7ff7bd3b29fc-7ff7bd3b2a0b call 7ff7bd3b47a0 524->540 529 7ff7bd3b2952-7ff7bd3b2968 call 7ff7bd3b1c50 525->529 535 7ff7bd3b2945-7ff7bd3b294d call 7ff7bd3be61c 526->535 536 7ff7bd3b296d-7ff7bd3b297b 526->536 529->468 538 7ff7bd3b2af6-7ff7bd3b2b05 call 7ff7bd3b2330 532->538 539 7ff7bd3b2a49-7ff7bd3b2a56 532->539 535->529 536->500 538->468 554 7ff7bd3b2b0b-7ff7bd3b2b42 call 7ff7bd3b6090 call 7ff7bd3b5af0 call 7ff7bd3b4530 538->554 542 7ff7bd3b2a60-7ff7bd3b2a6a 539->542 552 7ff7bd3b2a0d-7ff7bd3b2a19 call 7ff7bd3b4720 540->552 553 7ff7bd3b2a2c-7ff7bd3b2a31 call 7ff7bd3b49f0 540->553 546 7ff7bd3b2a73-7ff7bd3b2a75 542->546 547 7ff7bd3b2a6c-7ff7bd3b2a71 542->547 550 7ff7bd3b2ac1-7ff7bd3b2af1 call 7ff7bd3b2490 call 7ff7bd3b22d0 call 7ff7bd3b2480 call 7ff7bd3b49f0 call 7ff7bd3b4f20 546->550 551 7ff7bd3b2a77-7ff7bd3b2a9a call 7ff7bd3b1b30 546->551 547->542 547->546 550->470 551->468 566 7ff7bd3b2aa0-7ff7bd3b2aab 551->566 552->553 567 7ff7bd3b2a1b-7ff7bd3b2a2a call 7ff7bd3b4df0 552->567 553->523 554->468 577 7ff7bd3b2b48-7ff7bd3b2b7d call 7ff7bd3b2490 call 7ff7bd3b6140 call 7ff7bd3b49f0 call 7ff7bd3b4f20 554->577 571 7ff7bd3b2ab0-7ff7bd3b2abf 566->571 567->532 571->550 571->571 590 7ff7bd3b2b7f-7ff7bd3b2b82 call 7ff7bd3b5e00 577->590 591 7ff7bd3b2b87-7ff7bd3b2b8a call 7ff7bd3b1ab0 577->591 590->591 594 7ff7bd3b2b8f-7ff7bd3b2b91 591->594 594->470
                                                                              APIs
                                                                                • Part of subcall function 00007FF7BD3B2CD0: GetModuleFileNameW.KERNEL32(?,00007FF7BD3B27C9,?,?,?,?,?,?), ref: 00007FF7BD3B2D01
                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF7BD3B29D5
                                                                                • Part of subcall function 00007FF7BD3B5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7BD3B2817,?,?,?,?,?,?), ref: 00007FF7BD3B5B2A
                                                                                • Part of subcall function 00007FF7BD3B5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B5B47
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                              • API String ID: 2344891160-3602715111
                                                                              • Opcode ID: 144c16ccd7672ff0b95d7af8685cd2bb33374b1d9a395c9c1d49ec4117b97591
                                                                              • Instruction ID: f506db1a5e6e5c821c4cfb531445107295d9188a9d343c27fddfd35e91286a1e
                                                                              • Opcode Fuzzy Hash: 144c16ccd7672ff0b95d7af8685cd2bb33374b1d9a395c9c1d49ec4117b97591
                                                                              • Instruction Fuzzy Hash: 13C19125A1C643D1EA68BB2994912FDF390AF66784FC04139FB4D4769FFE2CE5068720
                                                                              Function 00007FF7BD3B1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 595 7ff7bd3b1050-7ff7bd3b10ab call 7ff7bd3b99a0 598 7ff7bd3b10d3-7ff7bd3b10eb call 7ff7bd3c415c 595->598 599 7ff7bd3b10ad-7ff7bd3b10d2 call 7ff7bd3b1c50 595->599 604 7ff7bd3b1109-7ff7bd3b1119 call 7ff7bd3c415c 598->604 605 7ff7bd3b10ed-7ff7bd3b1104 call 7ff7bd3b1c10 598->605 611 7ff7bd3b1137-7ff7bd3b1147 604->611 612 7ff7bd3b111b-7ff7bd3b1132 call 7ff7bd3b1c10 604->612 610 7ff7bd3b126c-7ff7bd3b12a0 call 7ff7bd3b9680 call 7ff7bd3c4148 * 2 605->610 615 7ff7bd3b1150-7ff7bd3b1175 call 7ff7bd3be96c 611->615 612->610 621 7ff7bd3b125e 615->621 622 7ff7bd3b117b-7ff7bd3b1185 call 7ff7bd3be6e0 615->622 626 7ff7bd3b1264 621->626 622->621 629 7ff7bd3b118b-7ff7bd3b1197 622->629 626->610 630 7ff7bd3b11a0-7ff7bd3b11c8 call 7ff7bd3b7df0 629->630 633 7ff7bd3b1241-7ff7bd3b125c call 7ff7bd3b1c50 630->633 634 7ff7bd3b11ca-7ff7bd3b11cd 630->634 633->626 635 7ff7bd3b11cf-7ff7bd3b11d9 634->635 636 7ff7bd3b123c 634->636 638 7ff7bd3b1203-7ff7bd3b1206 635->638 639 7ff7bd3b11db-7ff7bd3b11e8 call 7ff7bd3bf0ac 635->639 636->633 641 7ff7bd3b1219-7ff7bd3b121e 638->641 642 7ff7bd3b1208-7ff7bd3b1216 call 7ff7bd3baed0 638->642 646 7ff7bd3b11ed-7ff7bd3b11f0 639->646 641->630 645 7ff7bd3b1220-7ff7bd3b1223 641->645 642->641 648 7ff7bd3b1225-7ff7bd3b1228 645->648 649 7ff7bd3b1237-7ff7bd3b123a 645->649 650 7ff7bd3b11f2-7ff7bd3b11fc call 7ff7bd3be6e0 646->650 651 7ff7bd3b11fe-7ff7bd3b1201 646->651 648->633 652 7ff7bd3b122a-7ff7bd3b1232 648->652 649->626 650->641 650->651 651->633 652->615
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                              • API String ID: 0-1655038675
                                                                              • Opcode ID: 75a8f361488b902336a9f66c708dd5ad1a5206faca2c9aa32f7c4d8285429985
                                                                              • Instruction ID: 472e0288a5ec5c3fb12d9c9b5fa75644befafebb37553e312b644ce63dfbf082
                                                                              • Opcode Fuzzy Hash: 75a8f361488b902336a9f66c708dd5ad1a5206faca2c9aa32f7c4d8285429985
                                                                              • Instruction Fuzzy Hash: 1351B322A0D642C5EA68BB19E4403B9F290FBA6794F844139EF4D4779EFE3CE505C710
                                                                              Function 00007FF7BD3CDF40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7BD3CE2DA,?,?,-00000018,00007FF7BD3CA393,?,?,?,00007FF7BD3CA28A,?,?,?,00007FF7BD3C54F2), ref: 00007FF7BD3CE0BC
                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF7BD3CE2DA,?,?,-00000018,00007FF7BD3CA393,?,?,?,00007FF7BD3CA28A,?,?,?,00007FF7BD3C54F2), ref: 00007FF7BD3CE0C8
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressFreeLibraryProc
                                                                              • String ID: api-ms-$ext-ms-
                                                                              • API String ID: 3013587201-537541572
                                                                              • Opcode ID: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                                                              • Instruction ID: 21ca648a56e317d33fd6f73d2a6f6aca1c4800d7577f034a1e09d5a53926f60c
                                                                              • Opcode Fuzzy Hash: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                                                              • Instruction Fuzzy Hash: 10411322B1DB22C1FA19EB1A9810575E291BF6AB90F8C413DDF0D5778AFE3CE4448364
                                                                              Function 00007FF7BD3CB09C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 681 7ff7bd3cb09c-7ff7bd3cb0c2 682 7ff7bd3cb0c4-7ff7bd3cb0d8 call 7ff7bd3c6078 call 7ff7bd3c6098 681->682 683 7ff7bd3cb0dd-7ff7bd3cb0e1 681->683 699 7ff7bd3cb4ce 682->699 685 7ff7bd3cb4b7-7ff7bd3cb4c3 call 7ff7bd3c6078 call 7ff7bd3c6098 683->685 686 7ff7bd3cb0e7-7ff7bd3cb0ee 683->686 705 7ff7bd3cb4c9 call 7ff7bd3c9f20 685->705 686->685 688 7ff7bd3cb0f4-7ff7bd3cb122 686->688 688->685 691 7ff7bd3cb128-7ff7bd3cb12f 688->691 694 7ff7bd3cb131-7ff7bd3cb143 call 7ff7bd3c6078 call 7ff7bd3c6098 691->694 695 7ff7bd3cb148-7ff7bd3cb14b 691->695 694->705 697 7ff7bd3cb4b3-7ff7bd3cb4b5 695->697 698 7ff7bd3cb151-7ff7bd3cb157 695->698 702 7ff7bd3cb4d1-7ff7bd3cb4e8 697->702 698->697 703 7ff7bd3cb15d-7ff7bd3cb160 698->703 699->702 703->694 706 7ff7bd3cb162-7ff7bd3cb187 703->706 705->699 709 7ff7bd3cb189-7ff7bd3cb18b 706->709 710 7ff7bd3cb1ba-7ff7bd3cb1c1 706->710 712 7ff7bd3cb1b2-7ff7bd3cb1b8 709->712 713 7ff7bd3cb18d-7ff7bd3cb194 709->713 714 7ff7bd3cb1c3-7ff7bd3cb1eb call 7ff7bd3ccc3c call 7ff7bd3c9f88 * 2 710->714 715 7ff7bd3cb196-7ff7bd3cb1ad call 7ff7bd3c6078 call 7ff7bd3c6098 call 7ff7bd3c9f20 710->715 717 7ff7bd3cb238-7ff7bd3cb24f 712->717 713->712 713->715 742 7ff7bd3cb1ed-7ff7bd3cb203 call 7ff7bd3c6098 call 7ff7bd3c6078 714->742 743 7ff7bd3cb208-7ff7bd3cb233 call 7ff7bd3cb8c4 714->743 746 7ff7bd3cb340 715->746 721 7ff7bd3cb251-7ff7bd3cb259 717->721 722 7ff7bd3cb2ca-7ff7bd3cb2d4 call 7ff7bd3d2acc 717->722 721->722 726 7ff7bd3cb25b-7ff7bd3cb25d 721->726 734 7ff7bd3cb35e 722->734 735 7ff7bd3cb2da-7ff7bd3cb2ef 722->735 726->722 727 7ff7bd3cb25f-7ff7bd3cb275 726->727 727->722 731 7ff7bd3cb277-7ff7bd3cb283 727->731 731->722 736 7ff7bd3cb285-7ff7bd3cb287 731->736 738 7ff7bd3cb363-7ff7bd3cb383 ReadFile 734->738 735->734 740 7ff7bd3cb2f1-7ff7bd3cb303 GetConsoleMode 735->740 736->722 741 7ff7bd3cb289-7ff7bd3cb2a1 736->741 744 7ff7bd3cb47d-7ff7bd3cb486 GetLastError 738->744 745 7ff7bd3cb389-7ff7bd3cb391 738->745 740->734 747 7ff7bd3cb305-7ff7bd3cb30d 740->747 741->722 751 7ff7bd3cb2a3-7ff7bd3cb2af 741->751 742->746 743->717 748 7ff7bd3cb4a3-7ff7bd3cb4a6 744->748 749 7ff7bd3cb488-7ff7bd3cb49e call 7ff7bd3c6098 call 7ff7bd3c6078 744->749 745->744 753 7ff7bd3cb397 745->753 750 7ff7bd3cb343-7ff7bd3cb34d call 7ff7bd3c9f88 746->750 747->738 755 7ff7bd3cb30f-7ff7bd3cb331 ReadConsoleW 747->755 759 7ff7bd3cb4ac-7ff7bd3cb4ae 748->759 760 7ff7bd3cb339-7ff7bd3cb33b call 7ff7bd3c600c 748->760 749->746 750->702 751->722 758 7ff7bd3cb2b1-7ff7bd3cb2b3 751->758 762 7ff7bd3cb39e-7ff7bd3cb3b3 753->762 764 7ff7bd3cb333 GetLastError 755->764 765 7ff7bd3cb352-7ff7bd3cb35c 755->765 758->722 769 7ff7bd3cb2b5-7ff7bd3cb2c5 758->769 759->750 760->746 762->750 771 7ff7bd3cb3b5-7ff7bd3cb3c0 762->771 764->760 765->762 769->722 774 7ff7bd3cb3c2-7ff7bd3cb3db call 7ff7bd3cacb4 771->774 775 7ff7bd3cb3e7-7ff7bd3cb3ef 771->775 783 7ff7bd3cb3e0-7ff7bd3cb3e2 774->783 776 7ff7bd3cb3f1-7ff7bd3cb403 775->776 777 7ff7bd3cb46b-7ff7bd3cb478 call 7ff7bd3caaf4 775->777 780 7ff7bd3cb405 776->780 781 7ff7bd3cb45e-7ff7bd3cb466 776->781 777->783 784 7ff7bd3cb40a-7ff7bd3cb411 780->784 781->750 783->750 786 7ff7bd3cb413-7ff7bd3cb417 784->786 787 7ff7bd3cb44d-7ff7bd3cb458 784->787 788 7ff7bd3cb433 786->788 789 7ff7bd3cb419-7ff7bd3cb420 786->789 787->781 791 7ff7bd3cb439-7ff7bd3cb449 788->791 789->788 790 7ff7bd3cb422-7ff7bd3cb426 789->790 790->788 792 7ff7bd3cb428-7ff7bd3cb431 790->792 791->784 793 7ff7bd3cb44b 791->793 792->791 793->781
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: f51be05eff67105166a8e0974f5b8922bd2b6cae86938e82961f641d8e49780a
                                                                              • Instruction ID: 80bfda2e179dac222cec5da69a796a9d6565723f865e5b59f535de7271ec42ac
                                                                              • Opcode Fuzzy Hash: f51be05eff67105166a8e0974f5b8922bd2b6cae86938e82961f641d8e49780a
                                                                              • Instruction Fuzzy Hash: B0C1B42290C786D1E658AB1994402BDFB51FBA3B80FDD0139DB4D0779BEE7DE4898720
                                                                              Function 00007FF7BD3CC5A0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 871 7ff7bd3cc5a0-7ff7bd3cc5c5 872 7ff7bd3cc893 871->872 873 7ff7bd3cc5cb-7ff7bd3cc5ce 871->873 876 7ff7bd3cc895-7ff7bd3cc8a5 872->876 874 7ff7bd3cc5d0-7ff7bd3cc602 call 7ff7bd3c9e54 873->874 875 7ff7bd3cc607-7ff7bd3cc633 873->875 874->876 878 7ff7bd3cc635-7ff7bd3cc63c 875->878 879 7ff7bd3cc63e-7ff7bd3cc644 875->879 878->874 878->879 881 7ff7bd3cc654-7ff7bd3cc669 call 7ff7bd3d2acc 879->881 882 7ff7bd3cc646-7ff7bd3cc64f call 7ff7bd3cb960 879->882 886 7ff7bd3cc783-7ff7bd3cc78c 881->886 887 7ff7bd3cc66f-7ff7bd3cc678 881->887 882->881 888 7ff7bd3cc7e0-7ff7bd3cc805 WriteFile 886->888 889 7ff7bd3cc78e-7ff7bd3cc794 886->889 887->886 890 7ff7bd3cc67e-7ff7bd3cc682 887->890 891 7ff7bd3cc810 888->891 892 7ff7bd3cc807-7ff7bd3cc80d GetLastError 888->892 893 7ff7bd3cc796-7ff7bd3cc799 889->893 894 7ff7bd3cc7cc-7ff7bd3cc7de call 7ff7bd3cc058 889->894 895 7ff7bd3cc693-7ff7bd3cc69e 890->895 896 7ff7bd3cc684-7ff7bd3cc68c call 7ff7bd3c3840 890->896 900 7ff7bd3cc813 891->900 892->891 901 7ff7bd3cc79b-7ff7bd3cc79e 893->901 902 7ff7bd3cc7b8-7ff7bd3cc7ca call 7ff7bd3cc278 893->902 915 7ff7bd3cc770-7ff7bd3cc777 894->915 897 7ff7bd3cc6af-7ff7bd3cc6c4 GetConsoleMode 895->897 898 7ff7bd3cc6a0-7ff7bd3cc6a9 895->898 896->895 906 7ff7bd3cc77c 897->906 907 7ff7bd3cc6ca-7ff7bd3cc6d0 897->907 898->886 898->897 909 7ff7bd3cc818 900->909 910 7ff7bd3cc824-7ff7bd3cc82e 901->910 911 7ff7bd3cc7a4-7ff7bd3cc7b6 call 7ff7bd3cc15c 901->911 902->915 906->886 913 7ff7bd3cc6d6-7ff7bd3cc6d9 907->913 914 7ff7bd3cc759-7ff7bd3cc76b call 7ff7bd3cbbe0 907->914 916 7ff7bd3cc81d 909->916 917 7ff7bd3cc830-7ff7bd3cc835 910->917 918 7ff7bd3cc88c-7ff7bd3cc891 910->918 911->915 920 7ff7bd3cc6e4-7ff7bd3cc6f2 913->920 921 7ff7bd3cc6db-7ff7bd3cc6de 913->921 914->915 915->909 916->910 923 7ff7bd3cc863-7ff7bd3cc86d 917->923 924 7ff7bd3cc837-7ff7bd3cc83a 917->924 918->876 928 7ff7bd3cc6f4 920->928 929 7ff7bd3cc750-7ff7bd3cc754 920->929 921->916 921->920 926 7ff7bd3cc874-7ff7bd3cc883 923->926 927 7ff7bd3cc86f-7ff7bd3cc872 923->927 930 7ff7bd3cc853-7ff7bd3cc85e call 7ff7bd3c6054 924->930 931 7ff7bd3cc83c-7ff7bd3cc84b 924->931 926->918 927->872 927->926 933 7ff7bd3cc6f8-7ff7bd3cc70f call 7ff7bd3d2b98 928->933 929->900 930->923 931->930 937 7ff7bd3cc711-7ff7bd3cc71d 933->937 938 7ff7bd3cc747-7ff7bd3cc74d GetLastError 933->938 939 7ff7bd3cc71f-7ff7bd3cc731 call 7ff7bd3d2b98 937->939 940 7ff7bd3cc73c-7ff7bd3cc743 937->940 938->929 939->938 944 7ff7bd3cc733-7ff7bd3cc73a 939->944 940->929 941 7ff7bd3cc745 940->941 941->933 944->940
                                                                              APIs
                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7BD3CC58B), ref: 00007FF7BD3CC6BC
                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7BD3CC58B), ref: 00007FF7BD3CC747
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ConsoleErrorLastMode
                                                                              • String ID:
                                                                              • API String ID: 953036326-0
                                                                              • Opcode ID: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                                                              • Instruction ID: 8514e83ca0e7feb7d6a8aeda6163a5a01d5fa30a26bc67b77cbc0fd8cd58bd02
                                                                              • Opcode Fuzzy Hash: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                                                              • Instruction Fuzzy Hash: A991A236B0C751C5F768AB6984402BDE7A0AB26788F9C413DDF0E57A8AEF38D4418720
                                                                              Function 00007FF7BD3CE96C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_isindst
                                                                              • String ID:
                                                                              • API String ID: 4170891091-0
                                                                              • Opcode ID: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                                                              • Instruction ID: b3e3ed580e8b1492829c924ad517ca4eaa5adbd984c187ed48e21132101f0ad5
                                                                              • Opcode Fuzzy Hash: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                                                              • Instruction Fuzzy Hash: BA51F972F0D311CAEB1CEF28995167CE765AB21359F94013DEF1E636DAEB38A4118710
                                                                              Function 00007FF7BD3C46F8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 1279662727-0
                                                                              • Opcode ID: 2e14a9a22f8bbc959da1ddaf4bea7386fc9969426b98b87380e1d1a6b88a1f24
                                                                              • Instruction ID: 80aa2333f4c1c823000293213d114e3ea0367026501973fcc005c8456ad276d4
                                                                              • Opcode Fuzzy Hash: 2e14a9a22f8bbc959da1ddaf4bea7386fc9969426b98b87380e1d1a6b88a1f24
                                                                              • Instruction Fuzzy Hash: 36419722E1C782C3E758AB649510369F660FBA6754F549338E76C03ADAEF6CB5E08710
                                                                              Function 00007FF7BD3BA52C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                              • String ID:
                                                                              • API String ID: 3058843127-0
                                                                              • Opcode ID: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                                                              • Instruction ID: 1e848b09286e92d3d617ca55b284786a80e8eef00a26ae849f771588371f352e
                                                                              • Opcode Fuzzy Hash: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                                                              • Instruction Fuzzy Hash: AA313F21A0CA06C6EA5CBB2C95513B9E291AF63784FC4403DF74D4729BFEACA5048738
                                                                              Function 00007FF7BD3C89F8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Process$CurrentExitTerminate
                                                                              • String ID:
                                                                              • API String ID: 1703294689-0
                                                                              • Opcode ID: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                                                              • Instruction ID: 8d9f7445b4ce7dc7d6ce0dda79984bb52ccd80f9e184eefc238529967e8f1dfa
                                                                              • Opcode Fuzzy Hash: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                                                              • Instruction Fuzzy Hash: 62D01714B0C702D2EA5C3B395965138D2111F7A700B84143CCA0F033ABED2DA54D4730
                                                                              Function 00007FF7BD3BE70C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                              • Instruction ID: 7df5a9fff5deb558690805e68ba1cbeea62d22569525da985e871d3600cffd1e
                                                                              • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                              • Instruction Fuzzy Hash: 7151B921A0D641C5E66CAA2D9800679F691EF52B64F984638FF7D577CFEE3CE4408720
                                                                              Function 00007FF7BD3CBA58 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileHandleType
                                                                              • String ID:
                                                                              • API String ID: 3000768030-0
                                                                              • Opcode ID: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                                                              • Instruction ID: 3e3b262315d10a1a55d30cef7d7bb90a9c2c315e0a3e93c011051081e756ead2
                                                                              • Opcode Fuzzy Hash: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                                                              • Instruction Fuzzy Hash: 51316321A1CB46C1DB689B1C8590179E650EB56BB0FAC032DDBAE073E9DF7DE491D310
                                                                              Function 00007FF7BD3CB774 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7BD3CB760,00000000,?,?,?,00007FF7BD3B1023,00007FF7BD3CB869), ref: 00007FF7BD3CB7C0
                                                                              • GetLastError.KERNEL32(?,?,?,?,?,00007FF7BD3CB760,00000000,?,?,?,00007FF7BD3B1023,00007FF7BD3CB869), ref: 00007FF7BD3CB7CA
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastPointer
                                                                              • String ID:
                                                                              • API String ID: 2976181284-0
                                                                              • Opcode ID: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                                                              • Instruction ID: d8f7600a7ce32ff25557009afb2b1e5f9e90fa3b24686f7a5ba1b4caff019032
                                                                              • Opcode Fuzzy Hash: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                                                              • Instruction Fuzzy Hash: 4F11C46171CB81C1DA54AB29A814069E761AB66BF4F984339EF7D077EEEE3CD0948700
                                                                              Function 00007FF7BD3C6AF8 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3C6975), ref: 00007FF7BD3C6B1B
                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3C6975), ref: 00007FF7BD3C6B31
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Time$System$FileLocalSpecific
                                                                              • String ID:
                                                                              • API String ID: 1707611234-0
                                                                              • Opcode ID: 695a997772c6d588bd3c19a829da3cd4efb67dac24a46cf8f274d2962167cdc2
                                                                              • Instruction ID: 10e2779cc233112943d8cf678764d8a6d10ce6b8c16b83c979252e1aed8aa264
                                                                              • Opcode Fuzzy Hash: 695a997772c6d588bd3c19a829da3cd4efb67dac24a46cf8f274d2962167cdc2
                                                                              • Instruction Fuzzy Hash: 8701822250C651C2D758AB19E40213AF7B0FB96761F940239E7AD025EDEF7DD050DB20
                                                                              Function 00007FF7BD3C9F88 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFreeHeapLast
                                                                              • String ID:
                                                                              • API String ID: 485612231-0
                                                                              • Opcode ID: 635cad2e0ff3992951b7a77c4f2b8b42bf407885737c95784d501ba83ef464ff
                                                                              • Instruction ID: 00a976503f583d56a9d85f6ac6997636b631affde30da6a8aebcf6fdc2fd4b35
                                                                              • Opcode Fuzzy Hash: 635cad2e0ff3992951b7a77c4f2b8b42bf407885737c95784d501ba83ef464ff
                                                                              • Instruction Fuzzy Hash: CAE04F51E0D302C2FF1C7BBA9464074E2515FB6742B89443CCA0D5726BFE2CA4898730
                                                                              Function 00007FF7BD3C6860 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DirectoryErrorLastRemove
                                                                              • String ID:
                                                                              • API String ID: 377330604-0
                                                                              • Opcode ID: 6ee4c4c1d826b64487a110c2ae4246bf529d87c63a5704ba62e6a74145362de3
                                                                              • Instruction ID: bd8335c1cf58d82f201e0ce414ed0613b6252d93681a8dd113fb0f2bcd57160f
                                                                              • Opcode Fuzzy Hash: 6ee4c4c1d826b64487a110c2ae4246bf529d87c63a5704ba62e6a74145362de3
                                                                              • Instruction Fuzzy Hash: 31D0C910F5C703C1E62C37BA1915178D5902F7A724FD40638C229832FBFE2CA5C90721
                                                                              Function 00007FF7BD3C70E4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeleteErrorFileLast
                                                                              • String ID:
                                                                              • API String ID: 2018770650-0
                                                                              • Opcode ID: e62d151a604f4e0a1f97514f12a36258322d99d4e44f7b0e6aef129f7c091d96
                                                                              • Instruction ID: 0932ecf04584acf0b6d204457c5495fe73f0a63f1403a2ede7dc04f4c1dc23cd
                                                                              • Opcode Fuzzy Hash: e62d151a604f4e0a1f97514f12a36258322d99d4e44f7b0e6aef129f7c091d96
                                                                              • Instruction Fuzzy Hash: 2FD0C910E5C603C1E61C37BB1959179D2901F77720FD4067CCA29822EAFE2CA0894721
                                                                              Function 00007FF7BD3CA198 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF7BD3CA015,?,?,00000000,00007FF7BD3CA0CA), ref: 00007FF7BD3CA206
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3CA015,?,?,00000000,00007FF7BD3CA0CA), ref: 00007FF7BD3CA210
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CloseErrorHandleLast
                                                                              • String ID:
                                                                              • API String ID: 918212764-0
                                                                              • Opcode ID: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                                                              • Instruction ID: 94a8bfa16f3a610a5fcb2c02a72d0e389d35d6ea297f3f4b8303a28699186b1e
                                                                              • Opcode Fuzzy Hash: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                                                              • Instruction Fuzzy Hash: 3D21C211F0C742C1EE68775898A0379D1919FA67A0F8C423DDF2E473DBEE6CA4848324
                                                                              Function 00007FF7BD3B5E00 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide_findclose
                                                                              • String ID:
                                                                              • API String ID: 2772937645-0
                                                                              • Opcode ID: f49b861ea7d3f103746b3a21f9c25844a1af0d2aa27eefd751e744e4ab09ae28
                                                                              • Instruction ID: 03b71d435549e49abec8bcb999560cdd6fc1b8f48923bdc37d808cfbc68232a1
                                                                              • Opcode Fuzzy Hash: f49b861ea7d3f103746b3a21f9c25844a1af0d2aa27eefd751e744e4ab09ae28
                                                                              • Instruction Fuzzy Hash: 83716A52E18AC581E615DB2CC5452FDB360F7A9B48F94E329DB8C12597FF28E2D9C700
                                                                              Function 00007FF7BD3CB4EC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 8f779a44aa3b0a3f4ccf073f5887973493dec229e4be6da509badb23d6131534
                                                                              • Instruction ID: f864e123c879d6212f0de0000b889d07b22aa495a481d8581d6b2c7ad2725250
                                                                              • Opcode Fuzzy Hash: 8f779a44aa3b0a3f4ccf073f5887973493dec229e4be6da509badb23d6131534
                                                                              • Instruction Fuzzy Hash: 6141B13290C341C3EA28AB1DE550279F3A0EB77785F980139D78A4369AEF2DE452C770
                                                                              Function 00007FF7BD3B6370 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _fread_nolock
                                                                              • String ID:
                                                                              • API String ID: 840049012-0
                                                                              • Opcode ID: 99bbfe1d2f05c0455474663fa123003f277943937db98f160d8ca22a423e34c6
                                                                              • Instruction ID: 8c134236b7549a175959a87fff95f7e4efc147e065a3dc9f43c3d1523a01fea5
                                                                              • Opcode Fuzzy Hash: 99bbfe1d2f05c0455474663fa123003f277943937db98f160d8ca22a423e34c6
                                                                              • Instruction Fuzzy Hash: 96216121B0C69285EA59AB1A69043BAF651BF56BD4FC85435EF4D0B78BEE3CE0418710
                                                                              Function 00007FF7BD3CAF7C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                                                              • Instruction ID: da99ae3c5094f18c32371a127a52da57c5ee026e545c045b906db27c012275d2
                                                                              • Opcode Fuzzy Hash: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                                                              • Instruction Fuzzy Hash: 3A319062A1C722C1E6197B69984137CEA50AB62B50FC9013DEB1D133DBEF7CE4818730
                                                                              Function 00007FF7BD3C8929 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                              • String ID:
                                                                              • API String ID: 3947729631-0
                                                                              • Opcode ID: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                                                              • Instruction ID: c4091e5f4d0e6922c94ae27b589d3c8e13dbc13b0f702dc47ef4de7438e10ad3
                                                                              • Opcode Fuzzy Hash: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                                                              • Instruction Fuzzy Hash: 4A21A631A08701D9EB1CAF68C4402FCB7A0EB15318F481639D76D47ADAEF38D685C761
                                                                              Function 00007FF7BD3C5548 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                              • Instruction ID: 3ad7a4d83fb595b817a0ea37005c77b075d8e4bc8c6d594f0435c154bbb9a820
                                                                              • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                              • Instruction Fuzzy Hash: CD115E22A0D741C1EA68BF59940027DE660BFA7B80F8C4439EB4C5779BEE3DE4408720
                                                                              Function 00007FF7BD3D57EC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                                                              • Instruction ID: 74628f5b9ad3b56525e40a76cef617878b4049ca4853c56d075e9c618593c4b9
                                                                              • Opcode Fuzzy Hash: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                                                              • Instruction Fuzzy Hash: D521A432A0C641C7D7649F1CD450369FA60FB96B54FA84238D75D476DAEF3DD4008B10
                                                                              Function 00007FF7BD3BE98C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                              • Instruction ID: 921dac09ad7f55a1eff9aea9a94ab918c84925bb4b627e228d6f6644898bffe2
                                                                              • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                              • Instruction Fuzzy Hash: 9F018221A0C74581EA48AB5A9901169F795BBA7FE0B884639EF5C67BDFEE3CE0114310
                                                                              Function 00007FF7BD3C64EC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 89f1a6046394815f14ac2edb09e2e5d8c749716ba98b122b0912a1bcf1d4c737
                                                                              • Instruction ID: 748b2f30643e5b43c76f8b212a49160b5701884aedae5f1c9f4c978055dbd8e7
                                                                              • Opcode Fuzzy Hash: 89f1a6046394815f14ac2edb09e2e5d8c749716ba98b122b0912a1bcf1d4c737
                                                                              • Instruction Fuzzy Hash: D0013C61A0D742C0FE687B296540179DA90AF66794FAC453DEB1C437EFFE2CE4808320
                                                                              Function 00007FF7BD3C6828 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
                                                                              • Instruction ID: 8ed51f4512fd27d5948f7759c2523ce508f1ee42d0839d5d46f832e5859d3e58
                                                                              • Opcode Fuzzy Hash: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
                                                                              • Instruction Fuzzy Hash: E2E0B691A0C316C2FA683AAC4592278DA519F66340FC8443DDB08172ABFD1D78885731
                                                                              Function 00007FF7BD3B64A0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DirectoryErrorLastRemove
                                                                              • String ID:
                                                                              • API String ID: 377330604-0
                                                                              • Opcode ID: efc5bac48e0eb0ffe74c9f21acabb1ae742049e90b115f0f612458e6ed3a3079
                                                                              • Instruction ID: 397ea53bb4f806c33e1d49b969d6fa4cb6597a9d5b8f56ed1ba249ce2be872ca
                                                                              • Opcode Fuzzy Hash: efc5bac48e0eb0ffe74c9f21acabb1ae742049e90b115f0f612458e6ed3a3079
                                                                              • Instruction Fuzzy Hash: 92419616D1CB85C1E655AB2895013BCF360FBB6744F84A236EB8D5719BFF28A5D8C310
                                                                              Function 00007FF7BD3CDEC8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF7BD3CAA26,?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E), ref: 00007FF7BD3CDF1D
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AllocHeap
                                                                              • String ID:
                                                                              • API String ID: 4292702814-0
                                                                              • Opcode ID: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                                                              • Instruction ID: eceb658cadcd62f0e1bdf87788e887ade637e137d5398de205b85939c94484da
                                                                              • Opcode Fuzzy Hash: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                                                              • Instruction Fuzzy Hash: E6F03755B0D307C0FE5C776AA9602B5E2906F76B80F8C5439EA0E8769BFE2CE4814330
                                                                              Function 00007FF7BD3CCC3C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF7BD3BF1F4,?,?,?,00007FF7BD3C0706,?,?,?,?,?,00007FF7BD3C276D), ref: 00007FF7BD3CCC7A
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AllocHeap
                                                                              • String ID:
                                                                              • API String ID: 4292702814-0
                                                                              • Opcode ID: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                                                              • Instruction ID: eb71ee05c0d57079bfb00c791d1ffbcfc5328c73ed70d3d1ad13473dcc92341f
                                                                              • Opcode Fuzzy Hash: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                                                              • Instruction Fuzzy Hash: D0F03A69A0D346C4FE2C77795950279D2805FA67A0F8C86389A2E872DBFD2CA4529330

                                                                              Non-executed Functions

                                                                              Function 00007FF7BD3B50B0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressProc
                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                              • API String ID: 190572456-2208601799
                                                                              • Opcode ID: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                                                              • Instruction ID: 69d35b04fdef8627c6349b3cc8a0e513b09fe4dd7d761d5941f657da2b768c6b
                                                                              • Opcode Fuzzy Hash: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                                                              • Instruction Fuzzy Hash: 51E1C565A5DB07D0EE0DBB0CA960174E2A1AF3A780BD8513DDB0D0726EFF7CA5489724
                                                                              Function 00007FF7BD3D325C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                              • API String ID: 808467561-2761157908
                                                                              • Opcode ID: 8e3f32220dbedb6b83d3a56d93bef729e8f640f2dff9788303e755a102ce7513
                                                                              • Instruction ID: 28e87ce8cd7bf34fcc610d06ca66068e5600c99f7a288089be00d6528862267e
                                                                              • Opcode Fuzzy Hash: 8e3f32220dbedb6b83d3a56d93bef729e8f640f2dff9788303e755a102ce7513
                                                                              • Instruction Fuzzy Hash: 6FB2E672A1C682CAE7689F68D4507FDF7A1FB65344F841139DB0957A8EEB38A900CF50
                                                                              Function 00007FF7BD3B6680 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(WideCharToMultiByte,00007FF7BD3B1CE4,?,?,00000000,00007FF7BD3B6914), ref: 00007FF7BD3B66A7
                                                                              • FormatMessageW.KERNEL32 ref: 00007FF7BD3B66D6
                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF7BD3B672C
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                              • API String ID: 2383786077-2573406579
                                                                              • Opcode ID: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                                                              • Instruction ID: c0594de0d79d9287b83c5eb124a60ad215728328735715f8b49cf5a0ad33081e
                                                                              • Opcode Fuzzy Hash: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                                                              • Instruction Fuzzy Hash: E821652161CA42C1E768AB19E860266F365FBAA344FC40139E74D876AEFF3CD545CB20
                                                                              Function 00007FF7BD3BAA3C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 3140674995-0
                                                                              • Opcode ID: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                                                              • Instruction ID: 0eac65721541c133260d158ed231f03ab8d088e641c7aa6c542a2b639c9bb498
                                                                              • Opcode Fuzzy Hash: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                                                              • Instruction Fuzzy Hash: CA318F72608A81CAEB649F64E8503E9B360FB65704F84403DDB4D43B99EF7CC208CB24
                                                                              Function 00007FF7BD3C9C54 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 1239891234-0
                                                                              • Opcode ID: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                                                              • Instruction ID: 23d136b3c591e737ceb4b0867e5d7f745a7fc403f2b42e10ec33473c45527440
                                                                              • Opcode Fuzzy Hash: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                                                              • Instruction Fuzzy Hash: DC316232608F81C6DB64DB29E8502ADB3A4FB95754F940139EB9D43B5AEF3CC545CB10
                                                                              Function 00007FF7BD3D0A44 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 2227656907-0
                                                                              • Opcode ID: 539584bc973764fdeb57c39dee6d85e67abf5b785ab6bac293b25a2b00955d70
                                                                              • Instruction ID: f0b33024d9b522623ecdda39b7fb5b1315b2b0e6bb01df6fdcaf477485176253
                                                                              • Opcode Fuzzy Hash: 539584bc973764fdeb57c39dee6d85e67abf5b785ab6bac293b25a2b00955d70
                                                                              • Instruction Fuzzy Hash: 66B1CC22B1D64AC1EA68AB29D4201B9E350EB66FD4F845139EF5D077CEEE7CE441C720
                                                                              Function 00007FF7BD3BA920 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                              • String ID:
                                                                              • API String ID: 2933794660-0
                                                                              • Opcode ID: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                                                              • Instruction ID: 6288fe12811421a8e06ab3f27ac4ff6fb891c1ad4a21f938270666553730db28
                                                                              • Opcode Fuzzy Hash: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                                                              • Instruction Fuzzy Hash: D7114F22B18F01CAEB00DF64E8542A8B3A4F729758F840D35DB6D477A9EF78D1548350
                                                                              Function 00007FF7BD3D2DC0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memcpy_s
                                                                              • String ID:
                                                                              • API String ID: 1502251526-0
                                                                              • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                              • Instruction ID: 8d297a2892ae913b98ace0637c64ca9cb311d578915f69ce8ba4b20aed441ee6
                                                                              • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                              • Instruction Fuzzy Hash: 56C1E472B1C686C7D7289F59E05466AF791F7A6B84F848139DB4A43749EB3DEC01CB00
                                                                              Function 00007FF7BD3D8BF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionRaise_clrfp
                                                                              • String ID:
                                                                              • API String ID: 15204871-0
                                                                              • Opcode ID: 7f7800ade579f0d6f16bfab74bfde48d1f128962063d5dbe27371a705b590b7f
                                                                              • Instruction ID: 0da6d51849ade0f428b60b05bd3f8af5adc125425cdc7a30f25e0ba31a51e391
                                                                              • Opcode Fuzzy Hash: 7f7800ade579f0d6f16bfab74bfde48d1f128962063d5dbe27371a705b590b7f
                                                                              • Instruction Fuzzy Hash: C3B18C73605B84CAEB1DCF2DC842368B7A0F791B48F188926DB5D837A9DB39E451CB10
                                                                              Function 00007FF7BD3B69F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Find$CloseFileFirst
                                                                              • String ID:
                                                                              • API String ID: 2295610775-0
                                                                              • Opcode ID: dc40c5d753e30fe3fc1e8c3801fb870584b7f8e0a0b7135dd7118dd934c1c4bb
                                                                              • Instruction ID: d4c0adaf30842c49700e56e335259c1252e9ba6e1c02832710d0ff711ad68e6b
                                                                              • Opcode Fuzzy Hash: dc40c5d753e30fe3fc1e8c3801fb870584b7f8e0a0b7135dd7118dd934c1c4bb
                                                                              • Instruction Fuzzy Hash: 13F02162A1C281C7EBA49F28E458366F350AB94324F844239E76C076DAEF3CD0488B10
                                                                              Function 00007FF7BD3C2A28 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: $
                                                                              • API String ID: 0-227171996
                                                                              • Opcode ID: 7bbf33436acad36ae8a1b43dc77540a41ad4992d9fd982d144688fd018ad6b29
                                                                              • Instruction ID: 7e43e7da7cfa5a9c8e6ca151cb7c33d9373c7175fce60c8cadffe97801fb2676
                                                                              • Opcode Fuzzy Hash: 7bbf33436acad36ae8a1b43dc77540a41ad4992d9fd982d144688fd018ad6b29
                                                                              • Instruction Fuzzy Hash: 17E1843AA0D746C5DB6CAE2D8090139F360FB66B44F985139DB5E0769AEE39D841C720
                                                                              Function 00007FF7BD3CD208 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: e+000$gfff
                                                                              • API String ID: 0-3030954782
                                                                              • Opcode ID: 533175c5a31c969ed4ab8aeb227c1284adb18f6ecb4834c3077741e0ab5839c5
                                                                              • Instruction ID: a08a5fd2cd10662c97f2a2db113c7e9de8fe662b5419317aa5a7e4b53c1ab532
                                                                              • Opcode Fuzzy Hash: 533175c5a31c969ed4ab8aeb227c1284adb18f6ecb4834c3077741e0ab5839c5
                                                                              • Instruction Fuzzy Hash: BD517E22B1C7C5C5E7289A39A800769F791F755B90F8C8235DB9C47ACAEF3DD4048710
                                                                              Function 00007FF7BD3CCD74 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: gfffffff
                                                                              • API String ID: 0-1523873471
                                                                              • Opcode ID: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                              • Instruction ID: 020476d81f2a205077e9bcccddd96f7da4a64846debd77759f1cb5c3bc44950f
                                                                              • Opcode Fuzzy Hash: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                              • Instruction Fuzzy Hash: A1A14773B0C78586EB29DB2DA4007A9F790EB62B84F488035DB8D4778AEE3DD402C311
                                                                              Function 00007FF7BD3C710C Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: TMP
                                                                              • API String ID: 3215553584-3125297090
                                                                              • Opcode ID: 985e0a801e29725e04b4583fc225105d37087a949469f4e17e32398978b5ab39
                                                                              • Instruction ID: 0b8fd62a6c1400980e60226103029e2b28e3ffeaf5c3ff218773574059ada6e6
                                                                              • Opcode Fuzzy Hash: 985e0a801e29725e04b4583fc225105d37087a949469f4e17e32398978b5ab39
                                                                              • Instruction Fuzzy Hash: 00515F51B0C70681EA6CBA2A59116BAD291AF66BC4BDC4438DF0D4769BFE3CE4428360
                                                                              Function 00007FF7BD3D2630 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: HeapProcess
                                                                              • String ID:
                                                                              • API String ID: 54951025-0
                                                                              • Opcode ID: fe4f89a29164ef60706ac008de4aa1412735d6976d80202131d31ba446223f83
                                                                              • Instruction ID: 72bac9d1a2ad8b420dfdd77f6325d7dc945e72f7f715062e4d46918a8a443a50
                                                                              • Opcode Fuzzy Hash: fe4f89a29164ef60706ac008de4aa1412735d6976d80202131d31ba446223f83
                                                                              • Instruction Fuzzy Hash: DEB09B10E0B745C2DF0C37156D4551492757F69710FC4003CC10C41325EF2C11A55710
                                                                              Function 00007FF7BD3C21EC Relevance: .4, Instructions: 351COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: be6bd4aeaf1a32ba0a400cf215f270628cf800823f5191017f2ae2dcea54fc97
                                                                              • Instruction ID: d4c2b6ea1a12ce3feeb5e94b4254b3bf53c2da891f999c993a9341d6ed4c4150
                                                                              • Opcode Fuzzy Hash: be6bd4aeaf1a32ba0a400cf215f270628cf800823f5191017f2ae2dcea54fc97
                                                                              • Instruction Fuzzy Hash: FBE1863AA0C742C6E76CAA2D8594379F791AB67754F9C4139CB0D072DEEF29E841C720
                                                                              Function 00007FF7BD3C2624 Relevance: .3, Instructions: 327COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: c7030e3183cde293472bd1af0c19cf6b5d71ff879be136be2a1b5beee93e2b61
                                                                              • Instruction ID: e7f5067a4e4effa0b226f774730934a2ab7ef2052cfd3b4c7c2d4bb5392475db
                                                                              • Opcode Fuzzy Hash: c7030e3183cde293472bd1af0c19cf6b5d71ff879be136be2a1b5beee93e2b61
                                                                              • Instruction Fuzzy Hash: 5ED1C72AA0C742C5E76CAA2D85D023DF790EB26B48F984139CF0D0769BEF39D855D760
                                                                              Function 00007FF7BD3B7430 Relevance: .3, Instructions: 287COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 87de8634ded3f4e8458923233739ad96d21dd7a231352b5b7c5ed9b2526c006a
                                                                              • Instruction ID: c38c5bf9d16c4f01a737080db349a33a018d15ae6e85baec8fa5d360e87e829e
                                                                              • Opcode Fuzzy Hash: 87de8634ded3f4e8458923233739ad96d21dd7a231352b5b7c5ed9b2526c006a
                                                                              • Instruction Fuzzy Hash: 65C1F9722241E08BE688EB29F45987A73D2F799309FC9403AEB8747786CA3DE414D750
                                                                              Function 00007FF7BD3C133C Relevance: .2, Instructions: 250COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: afbdd63b75b42ad7439867ca4b24ab3856e6f83d1386856208b462784abde87f
                                                                              • Instruction ID: 2071c7069f8ba5988a9f3cb6da4d10578e01f24417ba01d252d47edf088267e9
                                                                              • Opcode Fuzzy Hash: afbdd63b75b42ad7439867ca4b24ab3856e6f83d1386856208b462784abde87f
                                                                              • Instruction Fuzzy Hash: 0AB15B72A0C741C5E768AF2DC050269FBA0EB66B48F9C4139CB4E4739EEE29D450E764
                                                                              Function 00007FF7BD3C16D4 Relevance: .2, Instructions: 241COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 9fc8fd975d7067d56c776f48e591c75802337bcef6e3071df9449d276b1abfcc
                                                                              • Instruction ID: 9358ff68b995d28f2ef2f93300411dc8ec28164a8a4b8f0715ceacab07357b93
                                                                              • Opcode Fuzzy Hash: 9fc8fd975d7067d56c776f48e591c75802337bcef6e3071df9449d276b1abfcc
                                                                              • Instruction Fuzzy Hash: A7B17D76A0C745C5E769AF2D805022CFBA0E766B48FA80139CB4E4739AEF39D441E761
                                                                              Function 00007FF7BD3CD888 Relevance: .2, Instructions: 198COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: fcd5d989e7635e1d0b21fa60e30f3936793c7b8db49fcf77cee77a31b8038a54
                                                                              • Instruction ID: c80bd46e5ecef0d0f68b25871fbaad3100b4a8d3acb19a6bb57984e443371876
                                                                              • Opcode Fuzzy Hash: fcd5d989e7635e1d0b21fa60e30f3936793c7b8db49fcf77cee77a31b8038a54
                                                                              • Instruction Fuzzy Hash: CA81A572A0C781C5D778EB1DA440369E690FB97794F984239EB9D43B9EEE3DD4008B10
                                                                              Function 00007FF7BD3D58B0 Relevance: .2, Instructions: 183COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: d003bb86ff7f146e11c69d63177ddcecb431cf0828b5e126d5f920f3d1e621d2
                                                                              • Instruction ID: ae30881d322bf09bc1342ccc16839c6c7a0c3093e67655d36dfb04ee18871caa
                                                                              • Opcode Fuzzy Hash: d003bb86ff7f146e11c69d63177ddcecb431cf0828b5e126d5f920f3d1e621d2
                                                                              • Instruction Fuzzy Hash: 9961A822E1C252C5F76DA92C8460279E991AF63370FD8023DD75D476DAFE7DE8408B20
                                                                              Function 00007FF7BD3C0774 Relevance: .1, Instructions: 146COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                              • Instruction ID: eaa5f44d648d3b43d724cfd33a24a73681028a5c4690de351c2256cbd3cb4fd1
                                                                              • Opcode Fuzzy Hash: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                              • Instruction Fuzzy Hash: 4C517976A1C791C5E7289B2DC444228F3A0EB66F58F688135CB4D1779AEB3AE843C750
                                                                              Function 00007FF7BD3BFF54 Relevance: .1, Instructions: 146COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                              • Instruction ID: 2ea7bfb2dfbdb296b06fd4e9806e2138803d9284964c1f3e0e9127ab0da3b77f
                                                                              • Opcode Fuzzy Hash: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                              • Instruction Fuzzy Hash: 3051A637A1D751C1E7289B2DC040228F7A0EB66B58F685139DF4C1779AEB3BE852C750
                                                                              Function 00007FF7BD3C0364 Relevance: .1, Instructions: 146COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                              • Instruction ID: 0bfd30adec5dfad85760df82d06f7640ae6fa830ff825fa46a30688baedf6eba
                                                                              • Opcode Fuzzy Hash: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                              • Instruction Fuzzy Hash: 9B519836A1C791C6E7289B2DC04023DF360EB66B58F685135CB4D5779AEB3AE843C750
                                                                              Function 00007FF7BD3C0570 Relevance: .1, Instructions: 145COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                              • Instruction ID: ee8744a2e84c79c424fd36b7d3369b740fccabb71da378120a7d7f3c7ccfd187
                                                                              • Opcode Fuzzy Hash: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                              • Instruction Fuzzy Hash: F5519436A1C791C6E7289B2CC04023CE7A0EB66B58F684135CF4D5779AEF3AE852C750
                                                                              Function 00007FF7BD3BFD50 Relevance: .1, Instructions: 145COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                              • Instruction ID: f8cd8cdee2a003b6f6f7052b0b1a46aff2bf962efbfe0dbdc3f9124b314699e1
                                                                              • Opcode Fuzzy Hash: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                              • Instruction Fuzzy Hash: 5E51967261E651C5E7289B2CC040338F7A0EB56B58F686139EB4C1779EDB3BE852C750
                                                                              Function 00007FF7BD3C0160 Relevance: .1, Instructions: 145COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                              • Instruction ID: c16394ace70151c6c3e325e37ec6e2fc55417670e58757f49fbde312ed1f92f9
                                                                              • Opcode Fuzzy Hash: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                              • Instruction Fuzzy Hash: 53517236A1C791C6E7689B2DC040328F7A1EB66B58F684135CF4D1779EEB3AE842C750
                                                                              Function 00007FF7BD3C4FD0 Relevance: .1, Instructions: 138COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                              • Instruction ID: fd61a4680d9d1ef544828ac64ac077dc07f244ba0f34d4bf86a04ff803390e09
                                                                              • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                              • Instruction Fuzzy Hash: FA41A35290E75AC5ED99AA1C05087B5EE80DF33BA0EDC52B8DE99533CFED0C2586C320
                                                                              Function 00007FF7BD3C8D10 Relevance: .1, Instructions: 126COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFreeHeapLast
                                                                              • String ID:
                                                                              • API String ID: 485612231-0
                                                                              • Opcode ID: 4e626db8f672c8f9a68360c7389e8f7894e58d94442387c78e1b4a483649a916
                                                                              • Instruction ID: 5986fa41fef58bb13735e750cf9afd95540bf0f8b9a317951fb95923096a9009
                                                                              • Opcode Fuzzy Hash: 4e626db8f672c8f9a68360c7389e8f7894e58d94442387c78e1b4a483649a916
                                                                              • Instruction Fuzzy Hash: C8411562718A55D2EF0CDF2ED9241A9E391AB59FD0B8D903ADF0D87B59EE3CC5428310
                                                                              Function 00007FF7BD3C66D4 Relevance: .1, Instructions: 98COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
                                                                              • Instruction ID: 8293bfd92b633d7ca7ed72462472649338384c5c6995c711c8e9d978e328980b
                                                                              • Opcode Fuzzy Hash: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
                                                                              • Instruction Fuzzy Hash: 9E31C63270DB42C1E728AF29A94012DEAD5ABD6B90F48463CEB5D53BEAEF3CD0414714
                                                                              Function 00007FF7BD3D8A40 Relevance: .0, Instructions: 32COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 1f11e33a503e903f6fd17a98672f77b01e7338ee743f4d3b2c43cccbf09155b6
                                                                              • Instruction ID: 3d37c756fbd1c584e7965c9e5f67b8cdf315f42defee9bdc9ba9f42590ef8033
                                                                              • Opcode Fuzzy Hash: 1f11e33a503e903f6fd17a98672f77b01e7338ee743f4d3b2c43cccbf09155b6
                                                                              • Instruction Fuzzy Hash: D2F044717182958ADB9C9F6DB8026A9B7D0F758380F80803ED78D83A08D63C90508F14
                                                                              Function 00007FF7BD3BABE4 Relevance: .0, Instructions: 2COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: da48dd3124fb9caf3cd120bb8db444467ff7ae744a775920e6920fcf6cc11ced
                                                                              • Instruction ID: 00bd5f14988096925501048dea470c65ff2519679ab04701af439d11488dde5d
                                                                              • Opcode Fuzzy Hash: da48dd3124fb9caf3cd120bb8db444467ff7ae744a775920e6920fcf6cc11ced
                                                                              • Instruction Fuzzy Hash: E7A0012190CC02E1E698AB08E961130E220BB76300B810139E24D830AAAE6CA940D728
                                                                              Function 00007FF7BD3B2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F36
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F75
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F9A
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2FBF
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2FE7
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B300F
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B3037
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B305F
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B3087
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressProc
                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                              • API String ID: 190572456-3109299426
                                                                              • Opcode ID: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                                                              • Instruction ID: 701580494b77783a8a6760936e13967aa9aa2bdad5c922e1fa9ccedb97e52912
                                                                              • Opcode Fuzzy Hash: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                                                              • Instruction Fuzzy Hash: E942A665A0DB03D1EA5DBB0CF960174E2A1AF7A780BC4513DDA1E0726EFF7CA5489720
                                                                              Function 00007FF7BD3B6C00 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7BD3B6C3C
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                              • API String ID: 203985260-1562484376
                                                                              • Opcode ID: dfd2e6ae5ae4f06e2dcec91347fe620f2b8f19115178a136d0a7e781d69e4ee9
                                                                              • Instruction ID: a680af05ea21ee1ed3b8fa1f65f83a728125c3a93026b5def0747f8563ad7766
                                                                              • Opcode Fuzzy Hash: dfd2e6ae5ae4f06e2dcec91347fe620f2b8f19115178a136d0a7e781d69e4ee9
                                                                              • Instruction Fuzzy Hash: 5E419461A0DA02C1E618BB19AC5017AF6A1AF667C0FC8453CEB4D4769FFF3CE1418720
                                                                              Function 00007FF7BD3BF5D8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: f$f$p$p$f
                                                                              • API String ID: 3215553584-1325933183
                                                                              • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                              • Instruction ID: 269c89211061b848dca959544a91fdc492e0bd3d647a81a66cab1e842b20abf4
                                                                              • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                              • Instruction Fuzzy Hash: D1128222A0E143C6FB68BA18D054679F351EBA2754FC45139F789476CEEB7FE4808B21
                                                                              Function 00007FF7BD3B12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                              • API String ID: 0-3659356012
                                                                              • Opcode ID: 9db823990f91315a927dbcfa8556ce36822af028d0ca0bd1d3b1f37ffff75a1d
                                                                              • Instruction ID: f6986a33921d4d6c5305046179258a84407e4a2b6a45a00daea2516e2868f86b
                                                                              • Opcode Fuzzy Hash: 9db823990f91315a927dbcfa8556ce36822af028d0ca0bd1d3b1f37ffff75a1d
                                                                              • Instruction Fuzzy Hash: 59415F21A0C642C1EA58FB19A4513B9F3A0EB667D4FD4443AEB4D07A5EFE3CE541C710
                                                                              Function 00007FF7BD3BCFA0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                              • String ID: csm$csm$csm
                                                                              • API String ID: 849930591-393685449
                                                                              • Opcode ID: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                                                              • Instruction ID: 468d5dd6d38b11ca986ba912bd2d922aa65ad38380a56717e026a5e73c6b1c46
                                                                              • Opcode Fuzzy Hash: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                                                              • Instruction Fuzzy Hash: FDE1753690C745C6EB68AB69A4403ADF7A0FB56798F440139EF8E5775AEF38E041C710
                                                                              Function 00007FF7BD3B67D0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B686F
                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B68BF
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                              • API String ID: 626452242-27947307
                                                                              • Opcode ID: 3a9eaa4d48dfa929a96e8abe244da43a5b844615b7a4874281830bf30dfaf9a2
                                                                              • Instruction ID: 92af4557c0dff79542e140b82ab8862b59e1798be57e24192fb7cf8b642f02dc
                                                                              • Opcode Fuzzy Hash: 3a9eaa4d48dfa929a96e8abe244da43a5b844615b7a4874281830bf30dfaf9a2
                                                                              • Instruction Fuzzy Hash: 47419532A0DB82C1D624EF19B85016AF764FBA5790F984139EB8D47B9AEF3CD055C710
                                                                              Function 00007FF7BD3B6ED0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • WideCharToMultiByte.KERNEL32(00000000,00007FF7BD3B2D35,?,?,?,?,?,?), ref: 00007FF7BD3B6F11
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              • WideCharToMultiByte.KERNEL32(00000000,00007FF7BD3B2D35,?,?,?,?,?,?), ref: 00007FF7BD3B6F85
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                              • API String ID: 1717984340-27947307
                                                                              • Opcode ID: 5afdcdb59fb222a27107398a8b6c2bf27ae6caccf3d44a434106b937189859e6
                                                                              • Instruction ID: 33583444744e37d7b763640a9d7c862e1353f99fd043b47e74ca177c4c561d71
                                                                              • Opcode Fuzzy Hash: 5afdcdb59fb222a27107398a8b6c2bf27ae6caccf3d44a434106b937189859e6
                                                                              • Instruction Fuzzy Hash: 9E21932161DB42C5EB18AB1AAC50079FB61ABA5B80B984139E74D4776BFF3CE544C710
                                                                              Function 00007FF7BD3C93D4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: f$p$p
                                                                              • API String ID: 3215553584-1995029353
                                                                              • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                              • Instruction ID: 4cc6ef968586023c12b3e987560ed59142393eb3db0a1b3862314240e5cf4513
                                                                              • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                              • Instruction Fuzzy Hash: 2D12A122A0C343C6FB28BE19D464279E251EB62752FDE4139D789476CEEE3DE5908730
                                                                              Function 00007FF7BD3B6FC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                              • API String ID: 626452242-876015163
                                                                              • Opcode ID: c587d9df721d6d5f2ea3110ac275589e54037fbf0ff6ea62f868986421b6576b
                                                                              • Instruction ID: d2f47c1a21062996c9d1d6f679df1a63038ff6c4db0f2bbd3238e7bc3481b3cc
                                                                              • Opcode Fuzzy Hash: c587d9df721d6d5f2ea3110ac275589e54037fbf0ff6ea62f868986421b6576b
                                                                              • Instruction Fuzzy Hash: 7541C372A0CB42C5E614EF19A840265F6A5FB65780F984139EB8D47BAAEF3CD051C710
                                                                              Function 00007FF7BD3B55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FF7BD3B6DC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6DFA
                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7BD3B5931,?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B563F
                                                                              Strings
                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7BD3B5653
                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7BD3B569A
                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7BD3B5616
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                              • API String ID: 2001182103-3498232454
                                                                              • Opcode ID: b373b57cbe41deb0754166daaf063714267b67395664b0f7720f06d5c9520c04
                                                                              • Instruction ID: 43494b8ce88491b37edf37ec4e7fb5141a3698f6d491cecec88d530dcd0ac7d8
                                                                              • Opcode Fuzzy Hash: b373b57cbe41deb0754166daaf063714267b67395664b0f7720f06d5c9520c04
                                                                              • Instruction Fuzzy Hash: 6E316851B1D742C0FA69B72999153B9F251AFBA780FC44439EB4E4369FFE2CE1048720
                                                                              Function 00007FF7BD3BC258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC2DD
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC2EB
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC315
                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC35B
                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC367
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                              • String ID: api-ms-
                                                                              • API String ID: 2559590344-2084034818
                                                                              • Opcode ID: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                                                              • Instruction ID: 3e159bd9ae40d57ab114fb486dd6fbf3d946eac754b7529e0357083ffdcbeebc
                                                                              • Opcode Fuzzy Hash: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                                                              • Instruction Fuzzy Hash: D531E725A0E602C1EE69BB2A9410575F294BF6AB90FCD0538EF1D4735AFF3CE0448724
                                                                              Function 00007FF7BD3B6DC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6DFA
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6E80
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                              • API String ID: 1717984340-876015163
                                                                              • Opcode ID: 705d5e7388990673e4057f708bdfa41fc1795a7d6f27c416964fabcc6ec96bd2
                                                                              • Instruction ID: 43019b4954d51c81cb7c509cd164a11531004945b6041284c7f790dd7be236ee
                                                                              • Opcode Fuzzy Hash: 705d5e7388990673e4057f708bdfa41fc1795a7d6f27c416964fabcc6ec96bd2
                                                                              • Instruction Fuzzy Hash: A021D725B1CA42C1EB54EB2DF810166E361EBAA7C4F8C4139EB4C8376EFE2CD5818700
                                                                              Function 00007FF7BD3CA790 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA79F
                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA7B4
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA7D5
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA802
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA813
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA824
                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA83F
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value$ErrorLast
                                                                              • String ID:
                                                                              • API String ID: 2506987500-0
                                                                              • Opcode ID: 2edf535838d47d07e159287e64e919bbb9833f77d9c5416c102145f594fa91aa
                                                                              • Instruction ID: 29f4fc0e4a7f8aee5534c9c7f14c1e7fc5a4232ad2de6063861c5116dfcd1ed4
                                                                              • Opcode Fuzzy Hash: 2edf535838d47d07e159287e64e919bbb9833f77d9c5416c102145f594fa91aa
                                                                              • Instruction Fuzzy Hash: 47215E20F0D302C2F56C73696551239E6525FA77A0F98463CDA3E076CFFE2CA4418324
                                                                              Function 00007FF7BD3D70FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                              • String ID: CONOUT$
                                                                              • API String ID: 3230265001-3130406586
                                                                              • Opcode ID: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                                                              • Instruction ID: b842a94c9f96ababdf988789b92d1f6feeaba91113d7d4c8505609732cad9c64
                                                                              • Opcode Fuzzy Hash: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                                                              • Instruction Fuzzy Hash: AE11B721A1CA42C6E7549B0AF854325E2A0FB69BE4F444238DB1D437A9EF7CD4048714
                                                                              Function 00007FF7BD3CA908 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA917
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA94D
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA97A
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA98B
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA99C
                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA9B7
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value$ErrorLast
                                                                              • String ID:
                                                                              • API String ID: 2506987500-0
                                                                              • Opcode ID: 0908324b7ac9a3d747a6848fb68d48d79e4d89c371889db26e425d0a64325479
                                                                              • Instruction ID: ba54a310d88874236fbdb84d322050d41d40ac447218f561f1c323d22ed5de28
                                                                              • Opcode Fuzzy Hash: 0908324b7ac9a3d747a6848fb68d48d79e4d89c371889db26e425d0a64325479
                                                                              • Instruction Fuzzy Hash: 4D115E21A0C346C2F65C7329A552279E2424FAB7B0F89473CDA3E476DFFD2CA4418724
                                                                              Function 00007FF7BD3BBC18 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                              • String ID: csm$f
                                                                              • API String ID: 2395640692-629598281
                                                                              • Opcode ID: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                                                              • Instruction ID: c5102b279eed2fc118f84790d36a2eadaecb3b6f248f11b9dfcba135aaf7349f
                                                                              • Opcode Fuzzy Hash: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                                                              • Instruction Fuzzy Hash: C4519031A0E602CADB18AF19D504A29F755FB65B88F908538EB4A0774EEE3CE941C720
                                                                              Function 00007FF7BD3C8A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                              • API String ID: 4061214504-1276376045
                                                                              • Opcode ID: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                                                              • Instruction ID: c647239916c546d9985f5d89d7f9e4c67baf5d8d49787aca7db6d191eab41ae8
                                                                              • Opcode Fuzzy Hash: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                                                              • Instruction Fuzzy Hash: 75F0312561D702C1EA186B18E854379D360AFAB7A1F980239C76D465F9EF2CD1498724
                                                                              Function 00007FF7BD3D8834 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _set_statfp
                                                                              • String ID:
                                                                              • API String ID: 1156100317-0
                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                              • Instruction ID: e3c27ec6b527f42052d3c2c9959b2106fffc2fe0b8eae23766fc3a14d1e34fa5
                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                              • Instruction Fuzzy Hash: 22114C22E1CA0391F65D312CE466375D0426FB6364EA80A38E77E072DFEE2C7941CB20
                                                                              Function 00007FF7BD3CA9D0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CA9EF
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA0E
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA36
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA47
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA58
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value
                                                                              • String ID:
                                                                              • API String ID: 3702945584-0
                                                                              • Opcode ID: 09351de027a9279ca2a4c1b6434e165991dd483229a246c23f0232d6cbc44178
                                                                              • Instruction ID: 59194b0d37bfc73cba979a393629374cb6b84439a0779f473ab1b6d942d507bb
                                                                              • Opcode Fuzzy Hash: 09351de027a9279ca2a4c1b6434e165991dd483229a246c23f0232d6cbc44178
                                                                              • Instruction Fuzzy Hash: 76114D14A0C342C2F99C7329A65127AE2415FA77E0F8C963CEA3E476DFFD2CA4118324
                                                                              Function 00007FF7BD3CA864 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA875
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA894
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8BC
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8CD
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8DE
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value
                                                                              • String ID:
                                                                              • API String ID: 3702945584-0
                                                                              • Opcode ID: 3503e44f68c09ab1fcc5f97d2f28d09950786fdc08e97e82da204339743e9a53
                                                                              • Instruction ID: 5c27a8d0a23a98b6fa89a3ff85655f900ec52981e6f314d4c528d8e6b6ca2180
                                                                              • Opcode Fuzzy Hash: 3503e44f68c09ab1fcc5f97d2f28d09950786fdc08e97e82da204339743e9a53
                                                                              • Instruction Fuzzy Hash: C311C810E0D30AC2F9AC72695852279D6424FAB3A0E9C563CDB3D5B2CBFD2CB4519735
                                                                              Function 00007FF7BD3CF228 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                              • API String ID: 3215553584-1196891531
                                                                              • Opcode ID: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                                                              • Instruction ID: 9cdd842acd2f923cff1bfc5d4412d29f831739f658cae44d336a9dfc89414a46
                                                                              • Opcode Fuzzy Hash: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                                                              • Instruction Fuzzy Hash: 5A819232D0F342D5E76C6E2D8550278E790AB23788FD9407DCB099729FEA2EE5019321
                                                                              Function 00007FF7BD3BD478 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CallEncodePointerTranslator
                                                                              • String ID: MOC$RCC
                                                                              • API String ID: 3544855599-2084237596
                                                                              • Opcode ID: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                                                              • Instruction ID: 2491a4b6078eafa01a2e98c327d1514655d89949ec5a1c1c6e85c6e082fb8b79
                                                                              • Opcode Fuzzy Hash: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                                                              • Instruction Fuzzy Hash: 86618D36A08B45CAE7249F69E4403ADF7A0FB55B8CF44012AEF4E17B9ADB78E151C710
                                                                              Function 00007FF7BD3BD7D4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                              • String ID: csm$csm
                                                                              • API String ID: 3896166516-3733052814
                                                                              • Opcode ID: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                                                              • Instruction ID: 053b6a667b65d02205ce1cb63a92c8b126f2bd286cac6245723587ee3abe6c53
                                                                              • Opcode Fuzzy Hash: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                                                              • Instruction Fuzzy Hash: A751A53290C641C6DB78AB19A140368F7A0EB66B84F984139EB9E47B9EDF3CE450C710
                                                                              Function 00007FF7BD3B2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7BD3B27C9,?,?,?,?,?,?), ref: 00007FF7BD3B2D01
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastModuleName
                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                              • API String ID: 2776309574-1977442011
                                                                              • Opcode ID: f4519b566fb866c0e24e0c0f6095b74e6cdfdbd0a944601a087909324ed073f8
                                                                              • Instruction ID: 27384000befb7e05524c57c3c5200b51ba7d392859e3654e7c3acc8a16e0f3ef
                                                                              • Opcode Fuzzy Hash: f4519b566fb866c0e24e0c0f6095b74e6cdfdbd0a944601a087909324ed073f8
                                                                              • Instruction Fuzzy Hash: 4D017520B1D642D1FA69B728D4553B5E251AF7A380FC0003DEA4D872AFFE1CE145C724
                                                                              Function 00007FF7BD3CBBE0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                              • String ID:
                                                                              • API String ID: 2718003287-0
                                                                              • Opcode ID: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                                                              • Instruction ID: a9cb4ea5f669012141e1e3486195a00278acf6da7f37215adf90e947c09d2117
                                                                              • Opcode Fuzzy Hash: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                                                              • Instruction Fuzzy Hash: ECD1F072B08B85C9E714DF69D4401ACB7B1FB25798B884239CF4E57B9AEE38E046C710
                                                                              Function 00007FF7BD3C484C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                              • String ID:
                                                                              • API String ID: 2780335769-0
                                                                              • Opcode ID: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                                                              • Instruction ID: e3dfa5a85605567d9155ec7b302fe11245d513346fec6761870e2eb321187fbd
                                                                              • Opcode Fuzzy Hash: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                                                              • Instruction Fuzzy Hash: D8519F22A0C752C5FB58EF68D4503BDA3A1AB66B48F548538DF4D5768EEF38E4808720
                                                                              Function 00007FF7BD3D4DCC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                              • String ID: ?
                                                                              • API String ID: 1286766494-1684325040
                                                                              • Opcode ID: ea61919ac6f8524f279918af95d4a367ebe415bf813acb2bc51f70dff045491e
                                                                              • Instruction ID: d17d9ba8bb0e8347fdc6c9ddac3e3dc2d5c432fb368b4154733dda25059e991a
                                                                              • Opcode Fuzzy Hash: ea61919ac6f8524f279918af95d4a367ebe415bf813acb2bc51f70dff045491e
                                                                              • Instruction Fuzzy Hash: 3341D812A1C38395FB686729A451379D650EBA2BA4F544239EF5C07ADEFE3CD441CB10
                                                                              Function 00007FF7BD3C7FE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3C8012
                                                                                • Part of subcall function 00007FF7BD3C9F88: RtlFreeHeap.NTDLL(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7BD3BA495), ref: 00007FF7BD3C8030
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                              • String ID: C:\Users\user\Desktop\PDF_Resave.exe
                                                                              • API String ID: 3580290477-2412123782
                                                                              • Opcode ID: 8d8b2631746941ed8e9d93c586c1e08c09f8ebf82f2c91caf3ed4a0a8a2970d8
                                                                              • Instruction ID: b04708d4d979ec27fb3d421536f1bc1447a313af7229441e7e5bdac0ce27de34
                                                                              • Opcode Fuzzy Hash: 8d8b2631746941ed8e9d93c586c1e08c09f8ebf82f2c91caf3ed4a0a8a2970d8
                                                                              • Instruction Fuzzy Hash: A7418136A0C716D5EB1CAF2998500B9E694EF56780F994039EB4D03B8BEF39E5858320
                                                                              Function 00007FF7BD3CC278 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastWrite
                                                                              • String ID: U
                                                                              • API String ID: 442123175-4171548499
                                                                              • Opcode ID: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                                                              • Instruction ID: f190a49516a6666e16bcd2807a639ab5eee144e43fa92977ca968a1be397fd67
                                                                              • Opcode Fuzzy Hash: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                                                              • Instruction Fuzzy Hash: 87419132A1CB41C1DB649F29E8443A9E760FBA9794F884039EB4D87799EF3CD441C710
                                                                              Function 00007FF7BD3CE598 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentDirectory
                                                                              • String ID: :
                                                                              • API String ID: 1611563598-336475711
                                                                              • Opcode ID: 6ea6d4d4bc35d25bba8af1de083b0a6473d04d25c8de49d1e69948f0a07f610c
                                                                              • Instruction ID: c2cf92d24edbd2137cc49e877df280306f526e7003ea89c126b4233fa3620c2a
                                                                              • Opcode Fuzzy Hash: 6ea6d4d4bc35d25bba8af1de083b0a6473d04d25c8de49d1e69948f0a07f610c
                                                                              • Instruction Fuzzy Hash: 11210622B1C781C1EB28AB19D04426DF3A1FBA5B44FC9403DD74D1328AEF7CE9658B60
                                                                              Function 00007FF7BD3BE320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFileHeaderRaise
                                                                              • String ID: csm
                                                                              • API String ID: 2573137834-1018135373
                                                                              • Opcode ID: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                                                              • Instruction ID: 64289bdfc823a9ddaa8e3dd3567965a6a858180e18b3cfcba344a957ba26770c
                                                                              • Opcode Fuzzy Hash: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                                                              • Instruction Fuzzy Hash: A6113A3260CB4182EB259F19E540269F7A1FB99B84F584238EF8D07769EF3CD551CB40
                                                                              Function 00007FF7BD3CF09C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000000.00000002.1741912686.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000000.00000002.1741886960.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741951602.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1741989201.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000000.00000002.1742071853.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_0_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                              • String ID: :
                                                                              • API String ID: 2595371189-336475711
                                                                              • Opcode ID: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                                                              • Instruction ID: d60ea243c01b6f0165575908ce6eea43b20058adc4d7d487a53a972b5e6e5cd9
                                                                              • Opcode Fuzzy Hash: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                                                              • Instruction Fuzzy Hash: 9A01B12291D312C6F768BB28946127EE3A0EF66704FC8103DD74C4729BFE2DE5448B24

                                                                              Execution Graph

                                                                              Execution Coverage:1.2%
                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                              Signature Coverage:0%
                                                                              Total number of Nodes:845
                                                                              Total number of Limit Nodes:26
                                                                              execution_graph 117495 7ffdfb1a2b58 117496 7ffdfb399550 117495->117496 117497 7ffdfb39955a TlsFree 117496->117497 117498 7ff7bd3ba52c 117519 7ff7bd3ba70c 117498->117519 117501 7ff7bd3ba683 117618 7ff7bd3baa3c 7 API calls 2 library calls 117501->117618 117502 7ff7bd3ba54d __scrt_acquire_startup_lock 117504 7ff7bd3ba68d 117502->117504 117509 7ff7bd3ba56b __scrt_release_startup_lock 117502->117509 117619 7ff7bd3baa3c 7 API calls 2 library calls 117504->117619 117506 7ff7bd3ba590 117507 7ff7bd3ba698 __GetCurrentState 117508 7ff7bd3ba616 117527 7ff7bd3c8748 117508->117527 117509->117506 117509->117508 117615 7ff7bd3c8af4 45 API calls 117509->117615 117512 7ff7bd3ba61b 117533 7ff7bd3b1000 117512->117533 117516 7ff7bd3ba63f 117516->117507 117617 7ff7bd3ba8a0 7 API calls __scrt_initialize_crt 117516->117617 117518 7ff7bd3ba656 117518->117506 117620 7ff7bd3bacdc 117519->117620 117522 7ff7bd3ba73b 117622 7ff7bd3c91fc 117522->117622 117526 7ff7bd3ba545 117526->117501 117526->117502 117528 7ff7bd3c876d 117527->117528 117529 7ff7bd3c8758 117527->117529 117528->117512 117529->117528 117639 7ff7bd3c81d8 40 API calls __free_lconv_mon 117529->117639 117531 7ff7bd3c8776 117531->117528 117640 7ff7bd3c8598 12 API calls 3 library calls 117531->117640 117534 7ff7bd3b1011 117533->117534 117641 7ff7bd3b67d0 117534->117641 117536 7ff7bd3b1023 117648 7ff7bd3c4f8c 117536->117648 117538 7ff7bd3b27ab 117655 7ff7bd3b1af0 117538->117655 117544 7ff7bd3b27c9 117606 7ff7bd3b28ca 117544->117606 117671 7ff7bd3b2c50 117544->117671 117546 7ff7bd3b27fb 117546->117606 117674 7ff7bd3b5af0 117546->117674 117548 7ff7bd3b2817 117549 7ff7bd3b2863 117548->117549 117551 7ff7bd3b5af0 92 API calls 117548->117551 117689 7ff7bd3b6100 117549->117689 117555 7ff7bd3b2838 __std_exception_copy 117551->117555 117552 7ff7bd3b2878 117693 7ff7bd3b19d0 117552->117693 117555->117549 117560 7ff7bd3b6100 89 API calls 117555->117560 117556 7ff7bd3b296d 117557 7ff7bd3b2998 117556->117557 117798 7ff7bd3b24a0 86 API calls 117556->117798 117566 7ff7bd3b29db 117557->117566 117704 7ff7bd3b6dc0 117557->117704 117558 7ff7bd3b19d0 121 API calls 117562 7ff7bd3b28ae 117558->117562 117560->117549 117564 7ff7bd3b28b2 117562->117564 117565 7ff7bd3b28f0 117562->117565 117563 7ff7bd3b29b8 117567 7ff7bd3b29bd 117563->117567 117568 7ff7bd3b29ce SetDllDirectoryW 117563->117568 117760 7ff7bd3b1c50 117564->117760 117565->117556 117775 7ff7bd3b2de0 117565->117775 117718 7ff7bd3b4fa0 117566->117718 117571 7ff7bd3b1c50 86 API calls 117567->117571 117568->117566 117571->117606 117575 7ff7bd3b2912 117580 7ff7bd3b1c50 86 API calls 117575->117580 117578 7ff7bd3b29f8 117603 7ff7bd3b2a2a 117578->117603 117800 7ff7bd3b47a0 158 API calls 3 library calls 117578->117800 117579 7ff7bd3b2940 117579->117556 117582 7ff7bd3b2945 117579->117582 117580->117606 117581 7ff7bd3b2af6 117750 7ff7bd3b2330 117581->117750 117794 7ff7bd3be61c 117582->117794 117586 7ff7bd3b2a09 117589 7ff7bd3b2a2c 117586->117589 117801 7ff7bd3b4720 120 API calls 117586->117801 117588 7ff7bd3b2a49 117594 7ff7bd3b2a95 117588->117594 117804 7ff7bd3b1b30 117588->117804 117803 7ff7bd3b49f0 FreeLibrary 117589->117803 117594->117606 117722 7ff7bd3b22d0 117594->117722 117595 7ff7bd3b2a17 117595->117589 117597 7ff7bd3b2a1b 117595->117597 117596 7ff7bd3b2b2b 117598 7ff7bd3b5af0 92 API calls 117596->117598 117802 7ff7bd3b4df0 87 API calls 117597->117802 117601 7ff7bd3b2b37 117598->117601 117605 7ff7bd3b2b48 117601->117605 117601->117606 117602 7ff7bd3b2ad1 117808 7ff7bd3b49f0 FreeLibrary 117602->117808 117603->117581 117603->117588 117810 7ff7bd3b6140 94 API calls 2 library calls 117605->117810 117766 7ff7bd3ba110 117606->117766 117608 7ff7bd3b2b60 117811 7ff7bd3b49f0 FreeLibrary 117608->117811 117610 7ff7bd3b2b6c 117611 7ff7bd3b2b87 117610->117611 117812 7ff7bd3b5e00 98 API calls 2 library calls 117610->117812 117813 7ff7bd3b1ab0 74 API calls __std_exception_copy 117611->117813 117614 7ff7bd3b2b8f 117614->117606 117615->117508 117616 7ff7bd3bab90 GetModuleHandleW 117616->117516 117617->117518 117618->117504 117619->117507 117621 7ff7bd3ba72e __scrt_dllmain_crt_thread_attach 117620->117621 117621->117522 117621->117526 117623 7ff7bd3d265c 117622->117623 117624 7ff7bd3ba740 117623->117624 117627 7ff7bd3cbb60 117623->117627 117624->117526 117626 7ff7bd3bbe38 7 API calls 2 library calls 117624->117626 117626->117526 117638 7ff7bd3cf818 EnterCriticalSection 117627->117638 117629 7ff7bd3cbb70 117630 7ff7bd3c6cb8 43 API calls 117629->117630 117631 7ff7bd3cbb79 117630->117631 117633 7ff7bd3cb968 45 API calls 117631->117633 117637 7ff7bd3cbb87 117631->117637 117632 7ff7bd3cf878 _isindst LeaveCriticalSection 117634 7ff7bd3cbb93 117632->117634 117635 7ff7bd3cbb82 117633->117635 117634->117623 117636 7ff7bd3cba58 GetStdHandle GetFileType 117635->117636 117636->117637 117637->117632 117639->117531 117640->117528 117643 7ff7bd3b67ef 117641->117643 117642 7ff7bd3b6840 WideCharToMultiByte 117642->117643 117644 7ff7bd3b68e8 117642->117644 117643->117642 117643->117644 117645 7ff7bd3b6896 WideCharToMultiByte 117643->117645 117647 7ff7bd3b67f7 __std_exception_copy 117643->117647 117814 7ff7bd3b1cb0 86 API calls 117644->117814 117645->117643 117645->117644 117647->117536 117649 7ff7bd3cecd0 117648->117649 117651 7ff7bd3ced76 117649->117651 117653 7ff7bd3ced23 117649->117653 117816 7ff7bd3ceba8 71 API calls _fread_nolock 117651->117816 117815 7ff7bd3c9e54 37 API calls 2 library calls 117653->117815 117654 7ff7bd3ced4c 117654->117538 117656 7ff7bd3b1b05 117655->117656 117657 7ff7bd3b1b20 117656->117657 117817 7ff7bd3b1c10 86 API calls 117656->117817 117657->117606 117659 7ff7bd3b2cd0 117657->117659 117818 7ff7bd3ba140 117659->117818 117662 7ff7bd3b2d22 117821 7ff7bd3b6ed0 88 API calls 117662->117821 117663 7ff7bd3b2d0b 117820 7ff7bd3b1cb0 86 API calls 117663->117820 117666 7ff7bd3b2d1e 117668 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117666->117668 117667 7ff7bd3b2d35 117667->117666 117669 7ff7bd3b1c50 86 API calls 117667->117669 117670 7ff7bd3b2d5f 117668->117670 117669->117666 117670->117544 117672 7ff7bd3b1b30 49 API calls 117671->117672 117673 7ff7bd3b2c6d 117672->117673 117673->117546 117675 7ff7bd3b5afa 117674->117675 117676 7ff7bd3b6dc0 88 API calls 117675->117676 117677 7ff7bd3b5b1c GetEnvironmentVariableW 117676->117677 117678 7ff7bd3b5b86 117677->117678 117679 7ff7bd3b5b34 ExpandEnvironmentStringsW 117677->117679 117680 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117678->117680 117822 7ff7bd3b6ed0 88 API calls 117679->117822 117682 7ff7bd3b5b98 117680->117682 117682->117548 117683 7ff7bd3b5b5c 117683->117678 117684 7ff7bd3b5b66 117683->117684 117823 7ff7bd3c927c 37 API calls 2 library calls 117684->117823 117686 7ff7bd3b5b6e 117687 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117686->117687 117688 7ff7bd3b5b7e 117687->117688 117688->117548 117690 7ff7bd3b6dc0 88 API calls 117689->117690 117691 7ff7bd3b6117 SetEnvironmentVariableW 117690->117691 117692 7ff7bd3b612f __std_exception_copy 117691->117692 117692->117552 117694 7ff7bd3b1b30 49 API calls 117693->117694 117695 7ff7bd3b1a00 117694->117695 117696 7ff7bd3b1b30 49 API calls 117695->117696 117702 7ff7bd3b1a7a 117695->117702 117697 7ff7bd3b1a22 117696->117697 117698 7ff7bd3b2c50 49 API calls 117697->117698 117697->117702 117699 7ff7bd3b1a3b 117698->117699 117824 7ff7bd3b17b0 117699->117824 117702->117556 117702->117558 117703 7ff7bd3be61c 74 API calls 117703->117702 117705 7ff7bd3b6de1 MultiByteToWideChar 117704->117705 117706 7ff7bd3b6e67 MultiByteToWideChar 117704->117706 117707 7ff7bd3b6e07 117705->117707 117712 7ff7bd3b6e2c 117705->117712 117708 7ff7bd3b6eaf 117706->117708 117709 7ff7bd3b6e8a 117706->117709 117905 7ff7bd3b1cb0 86 API calls 117707->117905 117708->117563 117907 7ff7bd3b1cb0 86 API calls 117709->117907 117712->117706 117715 7ff7bd3b6e42 117712->117715 117713 7ff7bd3b6e9d 117713->117563 117714 7ff7bd3b6e1a 117714->117563 117906 7ff7bd3b1cb0 86 API calls 117715->117906 117717 7ff7bd3b6e55 117717->117563 117719 7ff7bd3b4fb5 117718->117719 117720 7ff7bd3b29e0 117719->117720 117908 7ff7bd3b1c10 86 API calls 117719->117908 117720->117603 117799 7ff7bd3b4c40 120 API calls 2 library calls 117720->117799 117909 7ff7bd3b3ac0 117722->117909 117725 7ff7bd3b231d 117725->117602 117727 7ff7bd3b22f4 117727->117725 117965 7ff7bd3b3840 117727->117965 117729 7ff7bd3b2300 117729->117725 117975 7ff7bd3b39a0 117729->117975 117731 7ff7bd3b230c 117731->117725 117732 7ff7bd3b2547 117731->117732 117733 7ff7bd3b255c 117731->117733 117734 7ff7bd3b1c50 86 API calls 117732->117734 117735 7ff7bd3b257c 117733->117735 117747 7ff7bd3b2592 __std_exception_copy 117733->117747 117738 7ff7bd3b2553 117734->117738 117736 7ff7bd3b1c50 86 API calls 117735->117736 117736->117738 117737 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117739 7ff7bd3b26ea 117737->117739 117738->117737 117739->117602 117742 7ff7bd3b1b30 49 API calls 117742->117747 117743 7ff7bd3b273f 117744 7ff7bd3b1c50 86 API calls 117743->117744 117744->117738 117745 7ff7bd3b2719 117746 7ff7bd3b1c50 86 API calls 117745->117746 117746->117738 117747->117738 117747->117742 117747->117743 117747->117745 117748 7ff7bd3b26f6 117747->117748 117980 7ff7bd3b12b0 117747->117980 118006 7ff7bd3b1780 86 API calls 117747->118006 117749 7ff7bd3b1c50 86 API calls 117748->117749 117749->117738 117755 7ff7bd3b23e4 117750->117755 117757 7ff7bd3b23a3 117750->117757 117751 7ff7bd3b2423 117752 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117751->117752 117754 7ff7bd3b2435 117752->117754 117754->117606 117809 7ff7bd3b6090 88 API calls __std_exception_copy 117754->117809 117755->117751 118146 7ff7bd3b1ab0 74 API calls __std_exception_copy 117755->118146 117757->117755 118090 7ff7bd3b1dc0 117757->118090 118145 7ff7bd3b1440 158 API calls 2 library calls 117757->118145 118147 7ff7bd3b1780 86 API calls 117757->118147 117761 7ff7bd3b1c6e 117760->117761 118242 7ff7bd3b1b90 117761->118242 117767 7ff7bd3ba119 117766->117767 117768 7ff7bd3b28de 117767->117768 117769 7ff7bd3ba1d0 IsProcessorFeaturePresent 117767->117769 117768->117616 117770 7ff7bd3ba1e8 117769->117770 118291 7ff7bd3ba3c4 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 117770->118291 117772 7ff7bd3ba1fb 118292 7ff7bd3ba190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 117772->118292 117776 7ff7bd3b2dec 117775->117776 117777 7ff7bd3b6dc0 88 API calls 117776->117777 117778 7ff7bd3b2e17 117777->117778 117779 7ff7bd3b6dc0 88 API calls 117778->117779 117780 7ff7bd3b2e2a 117779->117780 118293 7ff7bd3c5548 117780->118293 117783 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117784 7ff7bd3b290a 117783->117784 117784->117575 117785 7ff7bd3b6370 117784->117785 117786 7ff7bd3b6394 117785->117786 117787 7ff7bd3b646b __std_exception_copy 117786->117787 117788 7ff7bd3beca4 73 API calls 117786->117788 117787->117579 117789 7ff7bd3b63ae 117788->117789 117789->117787 118461 7ff7bd3c7aac 117789->118461 117791 7ff7bd3b63c3 117791->117787 117792 7ff7bd3beca4 73 API calls 117791->117792 117793 7ff7bd3be96c _fread_nolock 53 API calls 117791->117793 117792->117791 117793->117791 117795 7ff7bd3be64c 117794->117795 118477 7ff7bd3be3f8 117795->118477 117797 7ff7bd3be665 117797->117575 117798->117557 117799->117578 117800->117586 117801->117595 117802->117603 117803->117603 117805 7ff7bd3b1b55 117804->117805 117806 7ff7bd3c3c90 49 API calls 117805->117806 117807 7ff7bd3b1b78 117806->117807 117807->117594 117808->117606 117809->117596 117810->117608 117811->117610 117812->117611 117813->117614 117814->117647 117815->117654 117816->117654 117817->117657 117819 7ff7bd3b2cdc GetModuleFileNameW 117818->117819 117819->117662 117819->117663 117820->117666 117821->117667 117822->117683 117823->117686 117825 7ff7bd3b17d4 117824->117825 117828 7ff7bd3b17e4 117824->117828 117826 7ff7bd3b2de0 120 API calls 117825->117826 117826->117828 117827 7ff7bd3b6370 83 API calls 117829 7ff7bd3b1815 117827->117829 117828->117827 117857 7ff7bd3b1842 117828->117857 117829->117857 117858 7ff7bd3beca4 117829->117858 117831 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117833 7ff7bd3b19c0 117831->117833 117832 7ff7bd3b182b 117834 7ff7bd3b182f 117832->117834 117835 7ff7bd3b184c 117832->117835 117833->117702 117833->117703 117871 7ff7bd3b1c10 86 API calls 117834->117871 117862 7ff7bd3be96c 117835->117862 117839 7ff7bd3b1867 117872 7ff7bd3b1c10 86 API calls 117839->117872 117840 7ff7bd3beca4 73 API calls 117842 7ff7bd3b18d1 117840->117842 117843 7ff7bd3b18e3 117842->117843 117844 7ff7bd3b18fe 117842->117844 117873 7ff7bd3b1c10 86 API calls 117843->117873 117846 7ff7bd3be96c _fread_nolock 53 API calls 117844->117846 117847 7ff7bd3b1913 117846->117847 117847->117839 117848 7ff7bd3b1925 117847->117848 117865 7ff7bd3be6e0 117848->117865 117851 7ff7bd3b193d 117852 7ff7bd3b1c50 86 API calls 117851->117852 117852->117857 117853 7ff7bd3b1993 117855 7ff7bd3be61c 74 API calls 117853->117855 117853->117857 117854 7ff7bd3b1950 117854->117853 117856 7ff7bd3b1c50 86 API calls 117854->117856 117855->117857 117856->117853 117857->117831 117859 7ff7bd3becd4 117858->117859 117874 7ff7bd3bea34 117859->117874 117861 7ff7bd3beced 117861->117832 117887 7ff7bd3be98c 117862->117887 117866 7ff7bd3be6e9 117865->117866 117868 7ff7bd3b1939 117865->117868 117903 7ff7bd3c6098 11 API calls _findclose 117866->117903 117868->117851 117868->117854 117869 7ff7bd3be6ee 117904 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 117869->117904 117871->117857 117872->117857 117873->117857 117875 7ff7bd3bea9e 117874->117875 117876 7ff7bd3bea5e 117874->117876 117875->117876 117877 7ff7bd3beaaa 117875->117877 117886 7ff7bd3c9e54 37 API calls 2 library calls 117876->117886 117885 7ff7bd3c439c EnterCriticalSection 117877->117885 117879 7ff7bd3bea85 117879->117861 117881 7ff7bd3beaaf 117882 7ff7bd3bebb8 71 API calls 117881->117882 117883 7ff7bd3beac1 117882->117883 117884 7ff7bd3c43a8 _fread_nolock LeaveCriticalSection 117883->117884 117884->117879 117886->117879 117888 7ff7bd3be9b6 117887->117888 117889 7ff7bd3b1861 117887->117889 117888->117889 117890 7ff7bd3bea02 117888->117890 117891 7ff7bd3be9c5 memcpy_s 117888->117891 117889->117839 117889->117840 117900 7ff7bd3c439c EnterCriticalSection 117890->117900 117901 7ff7bd3c6098 11 API calls _findclose 117891->117901 117893 7ff7bd3bea0a 117895 7ff7bd3be70c _fread_nolock 51 API calls 117893->117895 117897 7ff7bd3bea21 117895->117897 117896 7ff7bd3be9da 117902 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 117896->117902 117899 7ff7bd3c43a8 _fread_nolock LeaveCriticalSection 117897->117899 117899->117889 117901->117896 117903->117869 117905->117714 117906->117717 117907->117713 117908->117720 117910 7ff7bd3b3ad0 117909->117910 117911 7ff7bd3b1b30 49 API calls 117910->117911 117912 7ff7bd3b3b02 117911->117912 117913 7ff7bd3b3b2b 117912->117913 117914 7ff7bd3b3b0b 117912->117914 117916 7ff7bd3b3b82 117913->117916 118007 7ff7bd3b2e60 117913->118007 117915 7ff7bd3b1c50 86 API calls 117914->117915 117936 7ff7bd3b3b21 117915->117936 117917 7ff7bd3b2e60 49 API calls 117916->117917 117919 7ff7bd3b3b9b 117917->117919 117921 7ff7bd3b3bb9 117919->117921 117924 7ff7bd3b1c50 86 API calls 117919->117924 117920 7ff7bd3b3b4c 117922 7ff7bd3b3b6a 117920->117922 117926 7ff7bd3b1c50 86 API calls 117920->117926 118016 7ff7bd3b6320 117921->118016 118010 7ff7bd3b2d70 117922->118010 117923 7ff7bd3ba110 _wfindfirst32i64 8 API calls 117928 7ff7bd3b22de 117923->117928 117924->117921 117926->117922 117928->117725 117937 7ff7bd3b3e40 117928->117937 117929 7ff7bd3b3bc6 117931 7ff7bd3b3bed 117929->117931 117932 7ff7bd3b3bcb 117929->117932 118021 7ff7bd3b2f20 141 API calls 117931->118021 118020 7ff7bd3b1cb0 86 API calls 117932->118020 117935 7ff7bd3b6320 89 API calls 117935->117916 117936->117923 117938 7ff7bd3b5af0 92 API calls 117937->117938 117940 7ff7bd3b3e55 117938->117940 117939 7ff7bd3b3e70 117941 7ff7bd3b6dc0 88 API calls 117939->117941 117940->117939 117942 7ff7bd3b1c50 86 API calls 117940->117942 117943 7ff7bd3b3eb4 117941->117943 117942->117939 117944 7ff7bd3b3ed0 117943->117944 117945 7ff7bd3b3eb9 117943->117945 117948 7ff7bd3b6dc0 88 API calls 117944->117948 117946 7ff7bd3b1c50 86 API calls 117945->117946 117947 7ff7bd3b3ec5 117946->117947 117947->117727 117949 7ff7bd3b3f05 117948->117949 117951 7ff7bd3b1b30 49 API calls 117949->117951 117963 7ff7bd3b3f0a __std_exception_copy 117949->117963 117950 7ff7bd3b1c50 86 API calls 117952 7ff7bd3b40b1 117950->117952 117953 7ff7bd3b3f87 117951->117953 117952->117727 117954 7ff7bd3b3fb3 117953->117954 117955 7ff7bd3b3f8e 117953->117955 117957 7ff7bd3b6dc0 88 API calls 117954->117957 117956 7ff7bd3b1c50 86 API calls 117955->117956 117958 7ff7bd3b3fa3 117956->117958 117959 7ff7bd3b3fcc 117957->117959 117958->117727 117959->117963 118022 7ff7bd3b3c20 117959->118022 117963->117950 117964 7ff7bd3b409a 117963->117964 117964->117727 117966 7ff7bd3b3857 117965->117966 117966->117966 117967 7ff7bd3b3880 117966->117967 117971 7ff7bd3b3897 __std_exception_copy 117966->117971 117968 7ff7bd3b1c50 86 API calls 117967->117968 117969 7ff7bd3b388c 117968->117969 117969->117729 117970 7ff7bd3b397b 117970->117729 117971->117970 117972 7ff7bd3b12b0 120 API calls 117971->117972 117974 7ff7bd3b1c50 86 API calls 117971->117974 118064 7ff7bd3b1780 86 API calls 117971->118064 117972->117971 117974->117971 117976 7ff7bd3b39bb 117975->117976 117978 7ff7bd3b3aa7 117975->117978 117976->117978 117979 7ff7bd3b1c50 86 API calls 117976->117979 118065 7ff7bd3b1780 86 API calls 117976->118065 117978->117731 117979->117976 117981 7ff7bd3b12c6 117980->117981 117982 7ff7bd3b12f8 117980->117982 117984 7ff7bd3b2de0 120 API calls 117981->117984 117983 7ff7bd3beca4 73 API calls 117982->117983 117985 7ff7bd3b130a 117983->117985 117986 7ff7bd3b12d6 117984->117986 117988 7ff7bd3b132f 117985->117988 117989 7ff7bd3b130e 117985->117989 117986->117982 117987 7ff7bd3b12de 117986->117987 117990 7ff7bd3b1c50 86 API calls 117987->117990 117994 7ff7bd3b1364 117988->117994 117995 7ff7bd3b1344 117988->117995 118084 7ff7bd3b1c10 86 API calls 117989->118084 117992 7ff7bd3b12ee 117990->117992 117992->117747 117993 7ff7bd3b1325 117993->117747 117996 7ff7bd3b137e 117994->117996 118003 7ff7bd3b1395 117994->118003 118085 7ff7bd3b1c10 86 API calls 117995->118085 118066 7ff7bd3b1050 117996->118066 117999 7ff7bd3b1421 117999->117747 118000 7ff7bd3be96c _fread_nolock 53 API calls 118000->118003 118001 7ff7bd3be61c 74 API calls 118001->117999 118002 7ff7bd3b135f __std_exception_copy 118002->117999 118002->118001 118003->118000 118003->118002 118004 7ff7bd3b13de 118003->118004 118086 7ff7bd3b1c10 86 API calls 118004->118086 118006->117747 118008 7ff7bd3b1b30 49 API calls 118007->118008 118009 7ff7bd3b2e90 118008->118009 118009->117920 118009->118009 118011 7ff7bd3b2d7a 118010->118011 118012 7ff7bd3b6dc0 88 API calls 118011->118012 118013 7ff7bd3b2da2 118012->118013 118014 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118013->118014 118015 7ff7bd3b2dca 118014->118015 118015->117916 118015->117935 118017 7ff7bd3b6dc0 88 API calls 118016->118017 118018 7ff7bd3b6337 LoadLibraryExW 118017->118018 118019 7ff7bd3b6354 __std_exception_copy 118018->118019 118019->117929 118020->117936 118021->117936 118030 7ff7bd3b3c3a 118022->118030 118023 7ff7bd3b3df1 118024 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118023->118024 118025 7ff7bd3b3e10 118024->118025 118049 7ff7bd3b6fc0 88 API calls __std_exception_copy 118025->118049 118027 7ff7bd3b3d53 118027->118023 118052 7ff7bd3c92f4 118027->118052 118030->118023 118030->118027 118032 7ff7bd3b3e29 118030->118032 118050 7ff7bd3c5750 47 API calls 118030->118050 118051 7ff7bd3b1780 86 API calls 118030->118051 118034 7ff7bd3b1c50 86 API calls 118032->118034 118034->118023 118035 7ff7bd3b3d76 118036 7ff7bd3c92f4 _fread_nolock 37 API calls 118035->118036 118037 7ff7bd3b3d88 118036->118037 118059 7ff7bd3c585c 39 API calls 3 library calls 118037->118059 118039 7ff7bd3b3d94 118060 7ff7bd3c5de4 73 API calls 118039->118060 118041 7ff7bd3b3da6 118061 7ff7bd3c5de4 73 API calls 118041->118061 118043 7ff7bd3b3db8 118044 7ff7bd3c4f8c 71 API calls 118043->118044 118045 7ff7bd3b3dc9 118044->118045 118046 7ff7bd3c4f8c 71 API calls 118045->118046 118047 7ff7bd3b3ddd 118046->118047 118048 7ff7bd3c4f8c 71 API calls 118047->118048 118048->118023 118049->117963 118050->118030 118051->118030 118053 7ff7bd3b3d6a 118052->118053 118054 7ff7bd3c92fd 118052->118054 118058 7ff7bd3c585c 39 API calls 3 library calls 118053->118058 118062 7ff7bd3c6098 11 API calls _findclose 118054->118062 118056 7ff7bd3c9302 118063 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118056->118063 118058->118035 118059->118039 118060->118041 118061->118043 118062->118056 118064->117971 118065->117976 118067 7ff7bd3b10a6 118066->118067 118068 7ff7bd3b10d3 118067->118068 118069 7ff7bd3b10ad 118067->118069 118072 7ff7bd3b1109 118068->118072 118073 7ff7bd3b10ed 118068->118073 118070 7ff7bd3b1c50 86 API calls 118069->118070 118071 7ff7bd3b10c0 118070->118071 118071->118002 118075 7ff7bd3b111b 118072->118075 118081 7ff7bd3b1137 memcpy_s 118072->118081 118087 7ff7bd3b1c10 86 API calls 118073->118087 118088 7ff7bd3b1c10 86 API calls 118075->118088 118077 7ff7bd3be96c _fread_nolock 53 API calls 118077->118081 118078 7ff7bd3b1104 __std_exception_copy 118078->118002 118079 7ff7bd3b11fe 118080 7ff7bd3b1c50 86 API calls 118079->118080 118080->118078 118081->118077 118081->118078 118081->118079 118083 7ff7bd3be6e0 37 API calls 118081->118083 118089 7ff7bd3bf0ac 76 API calls 118081->118089 118083->118081 118084->117993 118085->118002 118086->118002 118087->118078 118088->118078 118089->118081 118091 7ff7bd3b1dd6 118090->118091 118092 7ff7bd3b1b30 49 API calls 118091->118092 118094 7ff7bd3b1e0b 118092->118094 118093 7ff7bd3b2211 118094->118093 118095 7ff7bd3b2c50 49 API calls 118094->118095 118096 7ff7bd3b1e7f 118095->118096 118148 7ff7bd3b2230 118096->118148 118099 7ff7bd3b1ec1 118156 7ff7bd3b5880 127 API calls 118099->118156 118100 7ff7bd3b1efa 118102 7ff7bd3b2230 75 API calls 118100->118102 118104 7ff7bd3b1f4c 118102->118104 118103 7ff7bd3b1ec9 118105 7ff7bd3b1eea 118103->118105 118157 7ff7bd3b5760 138 API calls 2 library calls 118103->118157 118106 7ff7bd3b1f50 118104->118106 118107 7ff7bd3b1fb6 118104->118107 118108 7ff7bd3b1c50 86 API calls 118105->118108 118112 7ff7bd3b1ef3 118105->118112 118158 7ff7bd3b5880 127 API calls 118106->118158 118110 7ff7bd3b2230 75 API calls 118107->118110 118108->118112 118113 7ff7bd3b1fe2 118110->118113 118116 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118112->118116 118115 7ff7bd3b2042 118113->118115 118117 7ff7bd3b2230 75 API calls 118113->118117 118114 7ff7bd3b1f58 118114->118105 118159 7ff7bd3b5760 138 API calls 2 library calls 118114->118159 118115->118093 118160 7ff7bd3b5880 127 API calls 118115->118160 118120 7ff7bd3b1fab 118116->118120 118121 7ff7bd3b2012 118117->118121 118120->117757 118121->118115 118124 7ff7bd3b2230 75 API calls 118121->118124 118122 7ff7bd3b1f75 118122->118105 118123 7ff7bd3b21f6 118122->118123 118128 7ff7bd3b1c50 86 API calls 118123->118128 118124->118115 118125 7ff7bd3b2052 118125->118093 118126 7ff7bd3b1af0 86 API calls 118125->118126 118138 7ff7bd3b216f 118125->118138 118127 7ff7bd3b20af 118126->118127 118127->118093 118131 7ff7bd3b1b30 49 API calls 118127->118131 118129 7ff7bd3b216a 118128->118129 118163 7ff7bd3b1ab0 74 API calls __std_exception_copy 118129->118163 118132 7ff7bd3b20d7 118131->118132 118132->118123 118134 7ff7bd3b1b30 49 API calls 118132->118134 118133 7ff7bd3b21db 118133->118123 118162 7ff7bd3b1440 158 API calls 2 library calls 118133->118162 118135 7ff7bd3b2104 118134->118135 118135->118123 118137 7ff7bd3b1b30 49 API calls 118135->118137 118139 7ff7bd3b2131 118137->118139 118138->118133 118161 7ff7bd3b1780 86 API calls 118138->118161 118139->118123 118141 7ff7bd3b17b0 121 API calls 118139->118141 118142 7ff7bd3b2153 118141->118142 118142->118138 118143 7ff7bd3b2157 118142->118143 118144 7ff7bd3b1c50 86 API calls 118143->118144 118144->118129 118145->117757 118146->117755 118147->117757 118149 7ff7bd3b2264 118148->118149 118164 7ff7bd3c3c90 118149->118164 118152 7ff7bd3b229b 118154 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118152->118154 118155 7ff7bd3b1ebd 118154->118155 118155->118099 118155->118100 118156->118103 118157->118105 118158->118114 118159->118122 118160->118125 118161->118138 118162->118133 118163->118093 118167 7ff7bd3c3cea 118164->118167 118165 7ff7bd3c3d0f 118199 7ff7bd3c9e54 37 API calls 2 library calls 118165->118199 118167->118165 118168 7ff7bd3c3d4b 118167->118168 118200 7ff7bd3c16d4 49 API calls _invalid_parameter_noinfo 118168->118200 118170 7ff7bd3c3de2 118174 7ff7bd3c3e28 118170->118174 118175 7ff7bd3c3dfd 118170->118175 118176 7ff7bd3c3e4c 118170->118176 118179 7ff7bd3c3df4 118170->118179 118171 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118173 7ff7bd3b228a 118171->118173 118173->118152 118182 7ff7bd3c4e80 118173->118182 118203 7ff7bd3c9f88 11 API calls 2 library calls 118174->118203 118201 7ff7bd3c9f88 11 API calls 2 library calls 118175->118201 118176->118174 118177 7ff7bd3c3e56 118176->118177 118202 7ff7bd3c9f88 11 API calls 2 library calls 118177->118202 118179->118174 118179->118175 118181 7ff7bd3c3d39 118181->118171 118183 7ff7bd3c4ea9 118182->118183 118184 7ff7bd3c4e9d 118182->118184 118229 7ff7bd3c4a94 45 API calls __GetCurrentState 118183->118229 118204 7ff7bd3c46f8 118184->118204 118187 7ff7bd3c4ed1 118191 7ff7bd3c4ee1 118187->118191 118230 7ff7bd3ce154 5 API calls __crtLCMapStringW 118187->118230 118190 7ff7bd3c4f39 118192 7ff7bd3c4f51 118190->118192 118193 7ff7bd3c4f3d 118190->118193 118231 7ff7bd3c457c 14 API calls 3 library calls 118191->118231 118195 7ff7bd3c46f8 69 API calls 118192->118195 118194 7ff7bd3c4ea2 118193->118194 118232 7ff7bd3c9f88 11 API calls 2 library calls 118193->118232 118194->118152 118197 7ff7bd3c4f5d 118195->118197 118197->118194 118233 7ff7bd3c9f88 11 API calls 2 library calls 118197->118233 118199->118181 118200->118170 118201->118181 118202->118181 118203->118181 118205 7ff7bd3c4712 118204->118205 118206 7ff7bd3c472f 118204->118206 118234 7ff7bd3c6078 11 API calls _findclose 118205->118234 118206->118205 118208 7ff7bd3c4742 CreateFileW 118206->118208 118210 7ff7bd3c4776 118208->118210 118211 7ff7bd3c47ac 118208->118211 118209 7ff7bd3c4717 118235 7ff7bd3c6098 11 API calls _findclose 118209->118235 118237 7ff7bd3c484c 59 API calls 3 library calls 118210->118237 118238 7ff7bd3c4d70 46 API calls 3 library calls 118211->118238 118215 7ff7bd3c47b1 118218 7ff7bd3c47e0 118215->118218 118219 7ff7bd3c47b5 118215->118219 118216 7ff7bd3c471f 118236 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118216->118236 118217 7ff7bd3c4784 118221 7ff7bd3c47a1 CloseHandle 118217->118221 118222 7ff7bd3c478b CloseHandle 118217->118222 118240 7ff7bd3c4b30 51 API calls 118218->118240 118239 7ff7bd3c600c 11 API calls 2 library calls 118219->118239 118225 7ff7bd3c472a 118221->118225 118222->118225 118225->118194 118226 7ff7bd3c47ed 118241 7ff7bd3c4c6c 21 API calls _fread_nolock 118226->118241 118228 7ff7bd3c47bf 118228->118225 118229->118187 118230->118191 118231->118190 118232->118194 118233->118194 118234->118209 118235->118216 118237->118217 118238->118215 118239->118228 118240->118226 118241->118228 118243 7ff7bd3b1bb6 118242->118243 118256 7ff7bd3c3b6c 118243->118256 118245 7ff7bd3b1bcc 118246 7ff7bd3b1d00 118245->118246 118247 7ff7bd3b1d10 118246->118247 118248 7ff7bd3c3c90 49 API calls 118247->118248 118249 7ff7bd3b1d58 118248->118249 118272 7ff7bd3b6c00 MultiByteToWideChar 118249->118272 118251 7ff7bd3b1d70 118252 7ff7bd3b1b90 78 API calls 118251->118252 118253 7ff7bd3b1d9e 118252->118253 118254 7ff7bd3ba110 _wfindfirst32i64 8 API calls 118253->118254 118255 7ff7bd3b1c9b 118254->118255 118255->117606 118257 7ff7bd3c3b96 118256->118257 118258 7ff7bd3c3bce 118257->118258 118260 7ff7bd3c3c01 118257->118260 118270 7ff7bd3c9e54 37 API calls 2 library calls 118258->118270 118263 7ff7bd3bf150 118260->118263 118262 7ff7bd3c3bf7 118262->118245 118271 7ff7bd3c439c EnterCriticalSection 118263->118271 118265 7ff7bd3bf16d 118266 7ff7bd3c1094 76 API calls 118265->118266 118267 7ff7bd3bf176 118266->118267 118268 7ff7bd3c43a8 _fread_nolock LeaveCriticalSection 118267->118268 118269 7ff7bd3bf180 118268->118269 118269->118262 118270->118262 118273 7ff7bd3b6c63 118272->118273 118274 7ff7bd3b6c49 118272->118274 118276 7ff7bd3b6c93 MultiByteToWideChar 118273->118276 118277 7ff7bd3b6c79 118273->118277 118287 7ff7bd3b1cb0 86 API calls 118274->118287 118279 7ff7bd3b6cd0 WideCharToMultiByte 118276->118279 118280 7ff7bd3b6cb6 118276->118280 118288 7ff7bd3b1cb0 86 API calls 118277->118288 118281 7ff7bd3b6d06 118279->118281 118284 7ff7bd3b6cfd 118279->118284 118289 7ff7bd3b1cb0 86 API calls 118280->118289 118283 7ff7bd3b6d2b WideCharToMultiByte 118281->118283 118281->118284 118283->118284 118286 7ff7bd3b6c5c __std_exception_copy 118283->118286 118290 7ff7bd3b1cb0 86 API calls 118284->118290 118286->118251 118287->118286 118288->118286 118289->118286 118290->118286 118291->117772 118294 7ff7bd3c547c 118293->118294 118295 7ff7bd3c54a2 118294->118295 118298 7ff7bd3c54d5 118294->118298 118324 7ff7bd3c6098 11 API calls _findclose 118295->118324 118297 7ff7bd3c54a7 118325 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118297->118325 118300 7ff7bd3c54e8 118298->118300 118301 7ff7bd3c54db 118298->118301 118312 7ff7bd3ca268 118300->118312 118326 7ff7bd3c6098 11 API calls _findclose 118301->118326 118304 7ff7bd3b2e39 118304->117783 118306 7ff7bd3c5509 118319 7ff7bd3cf52c 118306->118319 118307 7ff7bd3c54fc 118327 7ff7bd3c6098 11 API calls _findclose 118307->118327 118310 7ff7bd3c551c 118328 7ff7bd3c43a8 LeaveCriticalSection 118310->118328 118329 7ff7bd3cf818 EnterCriticalSection 118312->118329 118314 7ff7bd3ca27f 118315 7ff7bd3ca2dc 19 API calls 118314->118315 118316 7ff7bd3ca28a 118315->118316 118317 7ff7bd3cf878 _isindst LeaveCriticalSection 118316->118317 118318 7ff7bd3c54f2 118317->118318 118318->118306 118318->118307 118330 7ff7bd3cf228 118319->118330 118323 7ff7bd3cf586 118323->118310 118324->118297 118326->118304 118327->118304 118335 7ff7bd3cf263 __vcrt_InitializeCriticalSectionEx 118330->118335 118332 7ff7bd3cf501 118349 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118332->118349 118334 7ff7bd3cf433 118334->118323 118342 7ff7bd3d61ec 118334->118342 118340 7ff7bd3cf42a 118335->118340 118345 7ff7bd3d5504 51 API calls 3 library calls 118335->118345 118337 7ff7bd3cf495 118337->118340 118346 7ff7bd3d5504 51 API calls 3 library calls 118337->118346 118339 7ff7bd3cf4b4 118339->118340 118347 7ff7bd3d5504 51 API calls 3 library calls 118339->118347 118340->118334 118348 7ff7bd3c6098 11 API calls _findclose 118340->118348 118350 7ff7bd3d57ec 118342->118350 118345->118337 118346->118339 118347->118340 118348->118332 118351 7ff7bd3d5803 118350->118351 118353 7ff7bd3d5821 118350->118353 118404 7ff7bd3c6098 11 API calls _findclose 118351->118404 118353->118351 118355 7ff7bd3d583d 118353->118355 118354 7ff7bd3d5808 118405 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118354->118405 118361 7ff7bd3d5dfc 118355->118361 118359 7ff7bd3d5814 118359->118323 118407 7ff7bd3d5b30 118361->118407 118364 7ff7bd3d5e71 118439 7ff7bd3c6078 11 API calls _findclose 118364->118439 118365 7ff7bd3d5e89 118427 7ff7bd3c6e70 118365->118427 118368 7ff7bd3d5e76 118440 7ff7bd3c6098 11 API calls _findclose 118368->118440 118395 7ff7bd3d5868 118395->118359 118406 7ff7bd3c6e48 LeaveCriticalSection 118395->118406 118404->118354 118408 7ff7bd3d5b5c 118407->118408 118416 7ff7bd3d5b76 118407->118416 118408->118416 118452 7ff7bd3c6098 11 API calls _findclose 118408->118452 118410 7ff7bd3d5b6b 118453 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118410->118453 118412 7ff7bd3d5c45 118423 7ff7bd3d5ca2 118412->118423 118458 7ff7bd3c57ec 37 API calls 2 library calls 118412->118458 118413 7ff7bd3d5bf4 118413->118412 118456 7ff7bd3c6098 11 API calls _findclose 118413->118456 118416->118413 118454 7ff7bd3c6098 11 API calls _findclose 118416->118454 118417 7ff7bd3d5c9e 118420 7ff7bd3d5d20 118417->118420 118417->118423 118418 7ff7bd3d5c3a 118457 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118418->118457 118459 7ff7bd3c9f40 17 API calls _wfindfirst32i64 118420->118459 118422 7ff7bd3d5be9 118455 7ff7bd3c9f20 37 API calls _invalid_parameter_noinfo 118422->118455 118423->118364 118423->118365 118460 7ff7bd3cf818 EnterCriticalSection 118427->118460 118439->118368 118440->118395 118452->118410 118454->118422 118456->118418 118458->118417 118462 7ff7bd3c7adc 118461->118462 118465 7ff7bd3c75b8 118462->118465 118464 7ff7bd3c7af5 118464->117791 118466 7ff7bd3c7602 118465->118466 118467 7ff7bd3c75d3 118465->118467 118475 7ff7bd3c439c EnterCriticalSection 118466->118475 118476 7ff7bd3c9e54 37 API calls 2 library calls 118467->118476 118470 7ff7bd3c7607 118472 7ff7bd3c7624 38 API calls 118470->118472 118471 7ff7bd3c75f3 118471->118464 118473 7ff7bd3c7613 118472->118473 118474 7ff7bd3c43a8 _fread_nolock LeaveCriticalSection 118473->118474 118474->118471 118476->118471 118478 7ff7bd3be441 118477->118478 118479 7ff7bd3be413 118477->118479 118481 7ff7bd3be433 118478->118481 118487 7ff7bd3c439c EnterCriticalSection 118478->118487 118488 7ff7bd3c9e54 37 API calls 2 library calls 118479->118488 118481->117797 118483 7ff7bd3be458 118484 7ff7bd3be474 72 API calls 118483->118484 118485 7ff7bd3be464 118484->118485 118486 7ff7bd3c43a8 _fread_nolock LeaveCriticalSection 118485->118486 118486->118481 118488->118481 118489 7ff7bd3c8929 118501 7ff7bd3c9248 118489->118501 118491 7ff7bd3c892e 118492 7ff7bd3c8955 GetModuleHandleW 118491->118492 118493 7ff7bd3c899f 118491->118493 118492->118493 118499 7ff7bd3c8962 118492->118499 118494 7ff7bd3c882c 11 API calls 118493->118494 118495 7ff7bd3c89db 118494->118495 118496 7ff7bd3c89e2 118495->118496 118497 7ff7bd3c89f8 11 API calls 118495->118497 118498 7ff7bd3c89f4 118497->118498 118499->118493 118500 7ff7bd3c8a50 GetModuleHandleExW GetProcAddress FreeLibrary 118499->118500 118500->118493 118506 7ff7bd3ca790 45 API calls 3 library calls 118501->118506 118503 7ff7bd3c9251 118507 7ff7bd3c937c 45 API calls 2 library calls 118503->118507 118506->118503 118508 7ffe126de510 118509 7ffe126de586 118508->118509 118510 7ffe126e68a8 __acrt_iob_func 118508->118510 118620 7ffe126dee90 118509->118620 118624 7ffe126e71c8 __stdio_common_vfprintf 118510->118624 118513 7ffe126de5ec 118516 7ffe126dee90 PyErr_Format 118513->118516 118517 7ffe126e69af 118513->118517 118514 7ffe126e68cf __acrt_iob_func 118625 7ffe126e71c8 __stdio_common_vfprintf 118514->118625 118520 7ffe126de60f 118516->118520 118518 7ffe126e6a1f 118517->118518 118521 7ffe126e6a19 _Py_Dealloc 118517->118521 118522 7ffe126e6a34 118518->118522 118524 7ffe126e6a2b _Py_Dealloc 118518->118524 118519 7ffe126e68e9 __acrt_iob_func fputc 118526 7ffe126e6908 _Py_Dealloc 118519->118526 118520->118517 118523 7ffe126de61f PyType_Ready 118520->118523 118521->118518 118525 7ffe126e6a49 118522->118525 118528 7ffe126e6a40 _Py_Dealloc 118522->118528 118523->118517 118527 7ffe126de657 PyType_Ready 118523->118527 118524->118522 118529 7ffe126e6a5d 118525->118529 118532 7ffe126e6a54 _Py_Dealloc 118525->118532 118530 7ffe126e6917 _Py_Dealloc 118526->118530 118527->118517 118531 7ffe126de66c PyType_Ready 118527->118531 118528->118525 118533 7ffe126e6a7c 118529->118533 118534 7ffe126e6a76 _Py_Dealloc 118529->118534 118537 7ffe126e6926 _Py_Dealloc 118530->118537 118531->118517 118536 7ffe126de681 PyType_Ready 118531->118536 118532->118529 118535 7ffe126e6a9b 118533->118535 118538 7ffe126e6a95 _Py_Dealloc 118533->118538 118534->118533 118539 7ffe126e6aba 118535->118539 118541 7ffe126e6ab4 _Py_Dealloc 118535->118541 118536->118517 118540 7ffe126de696 PyUnicode_FromString 118536->118540 118545 7ffe126e6932 _Py_Dealloc 118537->118545 118538->118535 118542 7ffe126e6ad9 118539->118542 118546 7ffe126e6ad3 _Py_Dealloc 118539->118546 118543 7ffe126e69bc 118540->118543 118544 7ffe126de6af PyDict_SetItemString 118540->118544 118541->118539 118548 7ffe126e6af8 118542->118548 118552 7ffe126e6af2 _Py_Dealloc 118542->118552 118547 7ffe126e69d0 118543->118547 118550 7ffe126e69c7 _Py_Dealloc 118543->118550 118544->118543 118549 7ffe126de6ce PyDict_SetItemString 118544->118549 118556 7ffe126e693e _Py_Dealloc 118545->118556 118546->118542 118551 7ffe126e69e4 118547->118551 118557 7ffe126e69db _Py_Dealloc 118547->118557 118554 7ffe126e6b17 118548->118554 118559 7ffe126e6b11 _Py_Dealloc 118548->118559 118549->118543 118553 7ffe126de6ed 118549->118553 118550->118547 118551->118517 118560 7ffe126e69f3 _Py_Dealloc 118551->118560 118552->118548 118553->118526 118558 7ffe126de6f7 PyImport_ImportModule 118553->118558 118555 7ffe126e6b2b 118554->118555 118561 7ffe126e6b22 _Py_Dealloc 118554->118561 118563 7ffe126e694d _Py_Dealloc 118556->118563 118557->118551 118558->118547 118562 7ffe126de710 PyObject_GetAttrString 118558->118562 118559->118554 118560->118517 118561->118555 118562->118547 118564 7ffe126de730 PyObject_CallMethod 118562->118564 118567 7ffe126e6959 _Py_Dealloc 118563->118567 118564->118543 118565 7ffe126de75a 118564->118565 118565->118530 118566 7ffe126de764 PyObject_GetAttrString 118565->118566 118566->118547 118568 7ffe126de784 118566->118568 118569 7ffe126e6965 _Py_Dealloc 118567->118569 118568->118537 118568->118545 118570 7ffe126de7a5 PyImport_ImportModule 118568->118570 118572 7ffe126e6971 _Py_Dealloc 118569->118572 118570->118517 118571 7ffe126de7be PyObject_CallMethod 118570->118571 118571->118517 118573 7ffe126de7f8 PyUnicode_FromString 118571->118573 118574 7ffe126e6980 _Py_Dealloc 118572->118574 118573->118543 118575 7ffe126de811 PyDict_SetItemString 118573->118575 118577 7ffe126e698f PyModule_AddIntConstant 118574->118577 118575->118543 118576 7ffe126de837 118575->118576 118576->118556 118578 7ffe126de841 PyImport_ImportModule 118576->118578 118577->118517 118618 7ffe126ded3f 118577->118618 118578->118517 118579 7ffe126de85a PyObject_GetAttrString 118578->118579 118579->118517 118580 7ffe126de876 PyObject_CallFunction 118579->118580 118580->118517 118582 7ffe126de8ad 118580->118582 118581 7ffe126ded56 118583 7ffe126ded63 PyUnicode_InternFromString 118581->118583 118587 7ffe126dedba PyModule_AddStringConstant 118581->118587 118582->118563 118582->118567 118582->118569 118585 7ffe126de8e1 PyModule_Create2 118582->118585 118583->118517 118584 7ffe126ded89 PyModule_AddObject 118583->118584 118584->118517 118584->118581 118585->118517 118586 7ffe126de8ff PyModule_AddObject 118585->118586 118586->118517 118588 7ffe126de925 PyModule_AddObject 118586->118588 118587->118517 118589 7ffe126dedd9 PyModule_AddStringConstant 118587->118589 118588->118517 118590 7ffe126de94b PyModule_AddObject 118588->118590 118589->118543 118591 7ffe126dedfb 118589->118591 118590->118517 118592 7ffe126de96d PyErr_NewException 118590->118592 118592->118517 118593 7ffe126de997 PyModule_AddObject 118592->118593 118593->118517 118594 7ffe126de9b5 PyTuple_New 118593->118594 118594->118517 118600 7ffe126de9d0 118594->118600 118595 7ffe126dee16 PyTuple_Pack 118598 7ffe126dee37 PyTuple_Pack 118595->118598 118597 7ffe126dea0a PyTuple_Pack 118597->118517 118599 7ffe126dea28 PyErr_NewException 118597->118599 118598->118595 118599->118517 118599->118600 118600->118572 118600->118595 118600->118597 118600->118598 118601 7ffe126dea4e PyModule_AddObject 118600->118601 118614 7ffe126dea98 118600->118614 118601->118517 118601->118600 118602 7ffe126deb31 PyObject_CallObject 118602->118517 118603 7ffe126deb53 PyModule_AddObject 118602->118603 118603->118517 118606 7ffe126deb71 PyContextVar_New 118603->118606 118604 7ffe126deac3 PyTuple_Pack 118604->118517 118607 7ffe126deada PyErr_NewException 118604->118607 118605 7ffe126dee75 PyTuple_Pack 118605->118510 118606->118517 118608 7ffe126deb90 PyModule_AddObject 118606->118608 118607->118517 118607->118614 118608->118517 118609 7ffe126debb9 PyModule_AddObject 118608->118609 118609->118517 118611 7ffe126debe2 PyObject_CallObject 118609->118611 118610 7ffe126deb00 PyModule_AddObject 118610->118517 118610->118614 118611->118517 118612 7ffe126dec00 PyModule_AddObject 118611->118612 118612->118517 118613 7ffe126dec80 PyObject_CallObject 118612->118613 118613->118517 118615 7ffe126dec9b PyModule_AddObject 118613->118615 118614->118574 118614->118602 118614->118604 118614->118605 118614->118610 118615->118517 118616 7ffe126decf9 118615->118616 118617 7ffe126ded09 PyLong_FromSsize_t 118616->118617 118616->118618 118617->118517 118619 7ffe126ded1f PyModule_AddObject 118617->118619 118618->118577 118618->118581 118619->118543 118619->118616 118621 7ffe126e6b32 PyErr_Format 118620->118621 118622 7ffe126deea7 118620->118622 118621->118513 118622->118621 118623 7ffe126deee5 118622->118623 118623->118513 118624->118514 118625->118519

                                                                              Executed Functions

                                                                              Function 00007FF7BD3D5DFC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 304 7ff7bd3d5dfc-7ff7bd3d5e6f call 7ff7bd3d5b30 307 7ff7bd3d5e71-7ff7bd3d5e7a call 7ff7bd3c6078 304->307 308 7ff7bd3d5e89-7ff7bd3d5e93 call 7ff7bd3c6e70 304->308 313 7ff7bd3d5e7d-7ff7bd3d5e84 call 7ff7bd3c6098 307->313 314 7ff7bd3d5e95-7ff7bd3d5eac call 7ff7bd3c6078 call 7ff7bd3c6098 308->314 315 7ff7bd3d5eae-7ff7bd3d5f17 CreateFileW 308->315 331 7ff7bd3d61ca-7ff7bd3d61ea 313->331 314->313 317 7ff7bd3d5f94-7ff7bd3d5f9f GetFileType 315->317 318 7ff7bd3d5f19-7ff7bd3d5f1f 315->318 324 7ff7bd3d5fa1-7ff7bd3d5fdc GetLastError call 7ff7bd3c600c CloseHandle 317->324 325 7ff7bd3d5ff2-7ff7bd3d5ff9 317->325 321 7ff7bd3d5f61-7ff7bd3d5f8f GetLastError call 7ff7bd3c600c 318->321 322 7ff7bd3d5f21-7ff7bd3d5f25 318->322 321->313 322->321 329 7ff7bd3d5f27-7ff7bd3d5f5f CreateFileW 322->329 324->313 339 7ff7bd3d5fe2-7ff7bd3d5fed call 7ff7bd3c6098 324->339 327 7ff7bd3d6001-7ff7bd3d6004 325->327 328 7ff7bd3d5ffb-7ff7bd3d5fff 325->328 334 7ff7bd3d600a-7ff7bd3d605f call 7ff7bd3c6d88 327->334 335 7ff7bd3d6006 327->335 328->334 329->317 329->321 343 7ff7bd3d6061-7ff7bd3d606d call 7ff7bd3d5d38 334->343 344 7ff7bd3d607e-7ff7bd3d60af call 7ff7bd3d58b0 334->344 335->334 339->313 343->344 351 7ff7bd3d606f 343->351 349 7ff7bd3d60b5-7ff7bd3d60f7 344->349 350 7ff7bd3d60b1-7ff7bd3d60b3 344->350 353 7ff7bd3d6119-7ff7bd3d6124 349->353 354 7ff7bd3d60f9-7ff7bd3d60fd 349->354 352 7ff7bd3d6071-7ff7bd3d6079 call 7ff7bd3ca100 350->352 351->352 352->331 356 7ff7bd3d61c8 353->356 357 7ff7bd3d612a-7ff7bd3d612e 353->357 354->353 355 7ff7bd3d60ff-7ff7bd3d6114 354->355 355->353 356->331 357->356 359 7ff7bd3d6134-7ff7bd3d6179 CloseHandle CreateFileW 357->359 361 7ff7bd3d617b-7ff7bd3d61a9 GetLastError call 7ff7bd3c600c call 7ff7bd3c6fb0 359->361 362 7ff7bd3d61ae-7ff7bd3d61c3 359->362 361->362 362->356
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                              • String ID:
                                                                              • API String ID: 1617910340-0
                                                                              • Opcode ID: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                                                              • Instruction ID: 828f3d3319de8c9f82800a809c0269d92b7a49632210904c2268358630a2ba04
                                                                              • Opcode Fuzzy Hash: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                                                              • Instruction Fuzzy Hash: B0C1F433B1CA45C5EB14EF68C4901ACBB61F76AB98B450239DB2E573AAEF38D055C710
                                                                              Function 00007FFE126DE510 Relevance: 198.4, APIs: 78, Strings: 35, Instructions: 663COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740301447.00007FFE126C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE126C0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740277028.00007FFE126C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740368131.00007FFE126E9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740396766.00007FFE126F7000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740421707.00007FFE126F8000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740445059.00007FFE126F9000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740469746.00007FFE126FA000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe126c0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Module_Object$String$Object_$CallTuple_$Pack$Err_FromReadyType_$AttrDict_ExceptionImportImport_ItemModuleUnicode___acrt_iob_func$ConstantMethod$ContextCreate2FormatFunctionInternLong_Ssize_tVar_fputc
                                                                              • String ID: %s:%d: warning: $(O)$(ss)$1.70$2.5.1$BasicContext$Context$D:\a\1\s\Modules\_decimal\libmpdec\context.c$Decimal$DecimalException$DecimalTuple$DefaultContext$ExtendedContext$HAVE_CONTEXTVAR$HAVE_THREADS$MutableMapping$Number$Rational$SignalDict$__libmpdec_version__$__module__$__version__$as_integer_ratio$bit_length$collections$collections.abc$decimal$decimal.DecimalException$decimal_context$mpd_setminalloc: ignoring request to set MPD_MINALLOC a second time$namedtuple$numbers$register$s(OO){}$sign digits exponent
                                                                              • API String ID: 2210023312-630389593
                                                                              • Opcode ID: 3950c89dd7d0f46fa85523a6f954b02b05b136cfa4dcdb363a16ae3cdb450f87
                                                                              • Instruction ID: d4ec1de9929b7574cfe712798db7990386de190f770ef2284bcf54b3eb2e3999
                                                                              • Opcode Fuzzy Hash: 3950c89dd7d0f46fa85523a6f954b02b05b136cfa4dcdb363a16ae3cdb450f87
                                                                              • Instruction Fuzzy Hash: B462E361E0AF4785EB19CB27EC542B823A4BF58BA4F0451B5C94E467F4EFBCA985C304
                                                                              Function 00007FF7BD3B17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                              • API String ID: 3405171723-4158440160
                                                                              • Opcode ID: 3d57fbadd83ca00b5ee3a27cfc09c8de2ef1b8a7f7769bb7cec00fb7d522cde7
                                                                              • Instruction ID: b4bbd77f65c9b53a4da38963feb11938de0c1edaa2a4bb0781954b7bf57c4a3f
                                                                              • Opcode Fuzzy Hash: 3d57fbadd83ca00b5ee3a27cfc09c8de2ef1b8a7f7769bb7cec00fb7d522cde7
                                                                              • Instruction Fuzzy Hash: 45515E71A1DA46C6EB58EF2CD450278F3A0EB6AB44B904139EB0D8739EEE3CE540C750
                                                                              Function 00007FF7BD3B12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                              • API String ID: 0-3659356012
                                                                              • Opcode ID: b062efcf8f2c193bbae1d484d54a3a38d285118df6d9e6730312538d15cfbc06
                                                                              • Instruction ID: f6986a33921d4d6c5305046179258a84407e4a2b6a45a00daea2516e2868f86b
                                                                              • Opcode Fuzzy Hash: b062efcf8f2c193bbae1d484d54a3a38d285118df6d9e6730312538d15cfbc06
                                                                              • Instruction Fuzzy Hash: 59415F21A0C642C1EA58FB19A4513B9F3A0EB667D4FD4443AEB4D07A5EFE3CE541C710
                                                                              Function 00007FF7BD3B1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 430 7ff7bd3b1000-7ff7bd3b27b6 call 7ff7bd3be3f0 call 7ff7bd3be3e8 call 7ff7bd3b67d0 call 7ff7bd3ba140 call 7ff7bd3c4320 call 7ff7bd3c4f8c call 7ff7bd3b1af0 446 7ff7bd3b28ca 430->446 447 7ff7bd3b27bc-7ff7bd3b27cb call 7ff7bd3b2cd0 430->447 448 7ff7bd3b28cf-7ff7bd3b28ef call 7ff7bd3ba110 446->448 447->446 453 7ff7bd3b27d1-7ff7bd3b27e4 call 7ff7bd3b2ba0 447->453 453->446 456 7ff7bd3b27ea-7ff7bd3b27fd call 7ff7bd3b2c50 453->456 456->446 459 7ff7bd3b2803-7ff7bd3b282a call 7ff7bd3b5af0 456->459 462 7ff7bd3b286c-7ff7bd3b2894 call 7ff7bd3b6100 call 7ff7bd3b19d0 459->462 463 7ff7bd3b282c-7ff7bd3b283b call 7ff7bd3b5af0 459->463 474 7ff7bd3b289a-7ff7bd3b28b0 call 7ff7bd3b19d0 462->474 475 7ff7bd3b297d-7ff7bd3b298e 462->475 463->462 469 7ff7bd3b283d-7ff7bd3b2843 463->469 471 7ff7bd3b284f-7ff7bd3b2869 call 7ff7bd3c4148 call 7ff7bd3b6100 469->471 472 7ff7bd3b2845-7ff7bd3b284d 469->472 471->462 472->471 487 7ff7bd3b28b2-7ff7bd3b28c5 call 7ff7bd3b1c50 474->487 488 7ff7bd3b28f0-7ff7bd3b28f3 474->488 477 7ff7bd3b2990-7ff7bd3b299a call 7ff7bd3b24a0 475->477 478 7ff7bd3b29a3-7ff7bd3b29bb call 7ff7bd3b6dc0 475->478 490 7ff7bd3b29db-7ff7bd3b29e8 call 7ff7bd3b4fa0 477->490 491 7ff7bd3b299c 477->491 492 7ff7bd3b29bd-7ff7bd3b29c9 call 7ff7bd3b1c50 478->492 493 7ff7bd3b29ce-7ff7bd3b29d5 SetDllDirectoryW 478->493 487->446 488->475 489 7ff7bd3b28f9-7ff7bd3b2910 call 7ff7bd3b2de0 488->489 503 7ff7bd3b2912-7ff7bd3b2915 489->503 504 7ff7bd3b2917-7ff7bd3b2943 call 7ff7bd3b6370 489->504 501 7ff7bd3b2a36-7ff7bd3b2a3b call 7ff7bd3b4f20 490->501 502 7ff7bd3b29ea-7ff7bd3b29fa call 7ff7bd3b4c40 490->502 491->478 492->446 493->490 509 7ff7bd3b2a40-7ff7bd3b2a43 501->509 502->501 515 7ff7bd3b29fc-7ff7bd3b2a0b call 7ff7bd3b47a0 502->515 506 7ff7bd3b2952-7ff7bd3b2968 call 7ff7bd3b1c50 503->506 516 7ff7bd3b2945-7ff7bd3b294d call 7ff7bd3be61c 504->516 517 7ff7bd3b296d-7ff7bd3b297b 504->517 506->446 513 7ff7bd3b2af6-7ff7bd3b2afe call 7ff7bd3b2330 509->513 514 7ff7bd3b2a49-7ff7bd3b2a56 509->514 526 7ff7bd3b2b03-7ff7bd3b2b05 513->526 519 7ff7bd3b2a60-7ff7bd3b2a6a 514->519 530 7ff7bd3b2a0d-7ff7bd3b2a19 call 7ff7bd3b4720 515->530 531 7ff7bd3b2a2c-7ff7bd3b2a31 call 7ff7bd3b49f0 515->531 516->506 517->477 523 7ff7bd3b2a73-7ff7bd3b2a75 519->523 524 7ff7bd3b2a6c-7ff7bd3b2a71 519->524 528 7ff7bd3b2ac1-7ff7bd3b2ad6 call 7ff7bd3b2490 call 7ff7bd3b22d0 call 7ff7bd3b2480 523->528 529 7ff7bd3b2a77-7ff7bd3b2a9a call 7ff7bd3b1b30 523->529 524->519 524->523 526->446 532 7ff7bd3b2b0b-7ff7bd3b2b42 call 7ff7bd3b6090 call 7ff7bd3b5af0 call 7ff7bd3b4530 526->532 553 7ff7bd3b2adb-7ff7bd3b2af1 call 7ff7bd3b49f0 call 7ff7bd3b4f20 528->553 529->446 543 7ff7bd3b2aa0-7ff7bd3b2aab 529->543 530->531 542 7ff7bd3b2a1b-7ff7bd3b2a2a call 7ff7bd3b4df0 530->542 531->501 532->446 556 7ff7bd3b2b48-7ff7bd3b2b7d call 7ff7bd3b2490 call 7ff7bd3b6140 call 7ff7bd3b49f0 call 7ff7bd3b4f20 532->556 542->509 546 7ff7bd3b2ab0-7ff7bd3b2abf 543->546 546->528 546->546 553->448 568 7ff7bd3b2b7f-7ff7bd3b2b82 call 7ff7bd3b5e00 556->568 569 7ff7bd3b2b87-7ff7bd3b2b91 call 7ff7bd3b1ab0 556->569 568->569 569->448
                                                                              APIs
                                                                                • Part of subcall function 00007FF7BD3B2CD0: GetModuleFileNameW.KERNEL32(?,00007FF7BD3B27C9,?,?,?,?,?,?), ref: 00007FF7BD3B2D01
                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF7BD3B29D5
                                                                                • Part of subcall function 00007FF7BD3B5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7BD3B2817,?,?,?,?,?,?), ref: 00007FF7BD3B5B2A
                                                                                • Part of subcall function 00007FF7BD3B5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B5B47
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                              • API String ID: 2344891160-3602715111
                                                                              • Opcode ID: 1bcce19713f1ced71a1944ec487b66c2c1f8826570a39f9e2af0ada334e553cf
                                                                              • Instruction ID: f506db1a5e6e5c821c4cfb531445107295d9188a9d343c27fddfd35e91286a1e
                                                                              • Opcode Fuzzy Hash: 1bcce19713f1ced71a1944ec487b66c2c1f8826570a39f9e2af0ada334e553cf
                                                                              • Instruction Fuzzy Hash: 13C19125A1C643D1EA68BB2994912FDF390AF66784FC04139FB4D4769FFE2CE5068720
                                                                              Function 00007FF7BD3B1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 573 7ff7bd3b1050-7ff7bd3b10ab call 7ff7bd3b99a0 576 7ff7bd3b10d3-7ff7bd3b10eb call 7ff7bd3c415c 573->576 577 7ff7bd3b10ad-7ff7bd3b10d2 call 7ff7bd3b1c50 573->577 582 7ff7bd3b1109-7ff7bd3b1119 call 7ff7bd3c415c 576->582 583 7ff7bd3b10ed-7ff7bd3b1104 call 7ff7bd3b1c10 576->583 589 7ff7bd3b1137-7ff7bd3b1147 582->589 590 7ff7bd3b111b-7ff7bd3b1132 call 7ff7bd3b1c10 582->590 588 7ff7bd3b126c-7ff7bd3b12a0 call 7ff7bd3b9680 call 7ff7bd3c4148 * 2 583->588 592 7ff7bd3b1150-7ff7bd3b116d call 7ff7bd3be96c 589->592 590->588 597 7ff7bd3b1172-7ff7bd3b1175 592->597 600 7ff7bd3b125e 597->600 601 7ff7bd3b117b-7ff7bd3b1185 call 7ff7bd3be6e0 597->601 603 7ff7bd3b1264 600->603 601->600 607 7ff7bd3b118b-7ff7bd3b1197 601->607 603->588 608 7ff7bd3b11a0-7ff7bd3b11c8 call 7ff7bd3b7df0 607->608 611 7ff7bd3b1241-7ff7bd3b125c call 7ff7bd3b1c50 608->611 612 7ff7bd3b11ca-7ff7bd3b11cd 608->612 611->603 613 7ff7bd3b11cf-7ff7bd3b11d9 612->613 614 7ff7bd3b123c 612->614 616 7ff7bd3b1203-7ff7bd3b1206 613->616 617 7ff7bd3b11db-7ff7bd3b11f0 call 7ff7bd3bf0ac 613->617 614->611 620 7ff7bd3b1219-7ff7bd3b121e 616->620 621 7ff7bd3b1208-7ff7bd3b1216 call 7ff7bd3baed0 616->621 628 7ff7bd3b11f2-7ff7bd3b11fc call 7ff7bd3be6e0 617->628 629 7ff7bd3b11fe-7ff7bd3b1201 617->629 620->608 622 7ff7bd3b1220-7ff7bd3b1223 620->622 621->620 626 7ff7bd3b1225-7ff7bd3b1228 622->626 627 7ff7bd3b1237-7ff7bd3b123a 622->627 626->611 630 7ff7bd3b122a-7ff7bd3b1232 626->630 627->603 628->620 628->629 629->611 630->592
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                              • API String ID: 0-1655038675
                                                                              • Opcode ID: 835778965ba396b8c2d65636b0d4ee4ffcc8eef45f14a4a44827f752a2557c3a
                                                                              • Instruction ID: 472e0288a5ec5c3fb12d9c9b5fa75644befafebb37553e312b644ce63dfbf082
                                                                              • Opcode Fuzzy Hash: 835778965ba396b8c2d65636b0d4ee4ffcc8eef45f14a4a44827f752a2557c3a
                                                                              • Instruction Fuzzy Hash: 1351B322A0D642C5EA68BB19E4403B9F290FBA6794F844139EF4D4779EFE3CE505C710
                                                                              Function 00007FF7BD3CDF40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7BD3CE2DA,?,?,-00000018,00007FF7BD3CA393,?,?,?,00007FF7BD3CA28A,?,?,?,00007FF7BD3C54F2), ref: 00007FF7BD3CE0BC
                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF7BD3CE2DA,?,?,-00000018,00007FF7BD3CA393,?,?,?,00007FF7BD3CA28A,?,?,?,00007FF7BD3C54F2), ref: 00007FF7BD3CE0C8
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressFreeLibraryProc
                                                                              • String ID: api-ms-$ext-ms-
                                                                              • API String ID: 3013587201-537541572
                                                                              • Opcode ID: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                                                              • Instruction ID: 21ca648a56e317d33fd6f73d2a6f6aca1c4800d7577f034a1e09d5a53926f60c
                                                                              • Opcode Fuzzy Hash: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                                                              • Instruction Fuzzy Hash: 10411322B1DB22C1FA19EB1A9810575E291BF6AB90F8C413DDF0D5778AFE3CE4448364
                                                                              Function 00007FF7BD3CB09C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 659 7ff7bd3cb09c-7ff7bd3cb0c2 660 7ff7bd3cb0c4-7ff7bd3cb0d8 call 7ff7bd3c6078 call 7ff7bd3c6098 659->660 661 7ff7bd3cb0dd-7ff7bd3cb0e1 659->661 675 7ff7bd3cb4ce 660->675 662 7ff7bd3cb4b7-7ff7bd3cb4c3 call 7ff7bd3c6078 call 7ff7bd3c6098 661->662 663 7ff7bd3cb0e7-7ff7bd3cb0ee 661->663 682 7ff7bd3cb4c9 call 7ff7bd3c9f20 662->682 663->662 665 7ff7bd3cb0f4-7ff7bd3cb122 663->665 665->662 669 7ff7bd3cb128-7ff7bd3cb12f 665->669 672 7ff7bd3cb131-7ff7bd3cb143 call 7ff7bd3c6078 call 7ff7bd3c6098 669->672 673 7ff7bd3cb148-7ff7bd3cb14b 669->673 672->682 678 7ff7bd3cb4b3-7ff7bd3cb4b5 673->678 679 7ff7bd3cb151-7ff7bd3cb157 673->679 680 7ff7bd3cb4d1-7ff7bd3cb4e8 675->680 678->680 679->678 683 7ff7bd3cb15d-7ff7bd3cb160 679->683 682->675 683->672 686 7ff7bd3cb162-7ff7bd3cb187 683->686 688 7ff7bd3cb189-7ff7bd3cb18b 686->688 689 7ff7bd3cb1ba-7ff7bd3cb1c1 686->689 690 7ff7bd3cb1b2-7ff7bd3cb1b8 688->690 691 7ff7bd3cb18d-7ff7bd3cb194 688->691 692 7ff7bd3cb1c3-7ff7bd3cb1eb call 7ff7bd3ccc3c call 7ff7bd3c9f88 * 2 689->692 693 7ff7bd3cb196-7ff7bd3cb1ad call 7ff7bd3c6078 call 7ff7bd3c6098 call 7ff7bd3c9f20 689->693 695 7ff7bd3cb238-7ff7bd3cb24f 690->695 691->690 691->693 719 7ff7bd3cb1ed-7ff7bd3cb203 call 7ff7bd3c6098 call 7ff7bd3c6078 692->719 720 7ff7bd3cb208-7ff7bd3cb233 call 7ff7bd3cb8c4 692->720 723 7ff7bd3cb340 693->723 698 7ff7bd3cb251-7ff7bd3cb259 695->698 699 7ff7bd3cb2ca-7ff7bd3cb2d4 call 7ff7bd3d2acc 695->699 698->699 703 7ff7bd3cb25b-7ff7bd3cb25d 698->703 710 7ff7bd3cb35e 699->710 711 7ff7bd3cb2da-7ff7bd3cb2ef 699->711 703->699 707 7ff7bd3cb25f-7ff7bd3cb275 703->707 707->699 712 7ff7bd3cb277-7ff7bd3cb283 707->712 715 7ff7bd3cb363-7ff7bd3cb383 ReadFile 710->715 711->710 717 7ff7bd3cb2f1-7ff7bd3cb303 GetConsoleMode 711->717 712->699 718 7ff7bd3cb285-7ff7bd3cb287 712->718 721 7ff7bd3cb47d-7ff7bd3cb486 GetLastError 715->721 722 7ff7bd3cb389-7ff7bd3cb391 715->722 717->710 724 7ff7bd3cb305-7ff7bd3cb30d 717->724 718->699 725 7ff7bd3cb289-7ff7bd3cb2a1 718->725 719->723 720->695 731 7ff7bd3cb4a3-7ff7bd3cb4a6 721->731 732 7ff7bd3cb488-7ff7bd3cb49e call 7ff7bd3c6098 call 7ff7bd3c6078 721->732 722->721 728 7ff7bd3cb397 722->728 733 7ff7bd3cb343-7ff7bd3cb34d call 7ff7bd3c9f88 723->733 724->715 730 7ff7bd3cb30f-7ff7bd3cb331 ReadConsoleW 724->730 725->699 726 7ff7bd3cb2a3-7ff7bd3cb2af 725->726 726->699 734 7ff7bd3cb2b1-7ff7bd3cb2b3 726->734 738 7ff7bd3cb39e-7ff7bd3cb3b3 728->738 740 7ff7bd3cb333 GetLastError 730->740 741 7ff7bd3cb352-7ff7bd3cb35c 730->741 735 7ff7bd3cb4ac-7ff7bd3cb4ae 731->735 736 7ff7bd3cb339-7ff7bd3cb33b call 7ff7bd3c600c 731->736 732->723 733->680 734->699 745 7ff7bd3cb2b5-7ff7bd3cb2c5 734->745 735->733 736->723 738->733 747 7ff7bd3cb3b5-7ff7bd3cb3c0 738->747 740->736 741->738 745->699 751 7ff7bd3cb3c2-7ff7bd3cb3db call 7ff7bd3cacb4 747->751 752 7ff7bd3cb3e7-7ff7bd3cb3ef 747->752 759 7ff7bd3cb3e0-7ff7bd3cb3e2 751->759 756 7ff7bd3cb3f1-7ff7bd3cb403 752->756 757 7ff7bd3cb46b-7ff7bd3cb478 call 7ff7bd3caaf4 752->757 760 7ff7bd3cb405 756->760 761 7ff7bd3cb45e-7ff7bd3cb466 756->761 757->759 759->733 763 7ff7bd3cb40a-7ff7bd3cb411 760->763 761->733 764 7ff7bd3cb413-7ff7bd3cb417 763->764 765 7ff7bd3cb44d-7ff7bd3cb458 763->765 766 7ff7bd3cb433 764->766 767 7ff7bd3cb419-7ff7bd3cb420 764->767 765->761 769 7ff7bd3cb439-7ff7bd3cb449 766->769 767->766 768 7ff7bd3cb422-7ff7bd3cb426 767->768 768->766 770 7ff7bd3cb428-7ff7bd3cb431 768->770 769->763 771 7ff7bd3cb44b 769->771 770->769 771->761
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 5a4d685ae9cce30cf93841342e5a1d314e29f636783538e3b5adbfb391e49450
                                                                              • Instruction ID: 80bfda2e179dac222cec5da69a796a9d6565723f865e5b59f535de7271ec42ac
                                                                              • Opcode Fuzzy Hash: 5a4d685ae9cce30cf93841342e5a1d314e29f636783538e3b5adbfb391e49450
                                                                              • Instruction Fuzzy Hash: B0C1B42290C786D1E658AB1994402BDFB51FBA3B80FDD0139DB4D0779BEE7DE4898720
                                                                              Function 00007FF7BD3CC5A0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              • Executed
                                                                              • Not Executed
                                                                              control_flow_graph 837 7ff7bd3cc5a0-7ff7bd3cc5c5 838 7ff7bd3cc893 837->838 839 7ff7bd3cc5cb-7ff7bd3cc5ce 837->839 840 7ff7bd3cc895-7ff7bd3cc8a5 838->840 841 7ff7bd3cc5d0-7ff7bd3cc602 call 7ff7bd3c9e54 839->841 842 7ff7bd3cc607-7ff7bd3cc633 839->842 841->840 844 7ff7bd3cc635-7ff7bd3cc63c 842->844 845 7ff7bd3cc63e-7ff7bd3cc644 842->845 844->841 844->845 847 7ff7bd3cc654-7ff7bd3cc669 call 7ff7bd3d2acc 845->847 848 7ff7bd3cc646-7ff7bd3cc64f call 7ff7bd3cb960 845->848 852 7ff7bd3cc783-7ff7bd3cc78c 847->852 853 7ff7bd3cc66f-7ff7bd3cc678 847->853 848->847 854 7ff7bd3cc7e0-7ff7bd3cc805 WriteFile 852->854 855 7ff7bd3cc78e-7ff7bd3cc794 852->855 853->852 856 7ff7bd3cc67e-7ff7bd3cc682 853->856 861 7ff7bd3cc810 854->861 862 7ff7bd3cc807-7ff7bd3cc80d GetLastError 854->862 857 7ff7bd3cc796-7ff7bd3cc799 855->857 858 7ff7bd3cc7cc-7ff7bd3cc7d9 call 7ff7bd3cc058 855->858 859 7ff7bd3cc693-7ff7bd3cc69e 856->859 860 7ff7bd3cc684-7ff7bd3cc68c call 7ff7bd3c3840 856->860 863 7ff7bd3cc79b-7ff7bd3cc79e 857->863 864 7ff7bd3cc7b8-7ff7bd3cc7ca call 7ff7bd3cc278 857->864 875 7ff7bd3cc7de 858->875 866 7ff7bd3cc6af-7ff7bd3cc6c4 GetConsoleMode 859->866 867 7ff7bd3cc6a0-7ff7bd3cc6a9 859->867 860->859 869 7ff7bd3cc813 861->869 862->861 871 7ff7bd3cc824-7ff7bd3cc82e 863->871 872 7ff7bd3cc7a4-7ff7bd3cc7b6 call 7ff7bd3cc15c 863->872 885 7ff7bd3cc770-7ff7bd3cc777 864->885 876 7ff7bd3cc77c 866->876 877 7ff7bd3cc6ca-7ff7bd3cc6d0 866->877 867->852 867->866 870 7ff7bd3cc818 869->870 878 7ff7bd3cc81d 870->878 879 7ff7bd3cc830-7ff7bd3cc835 871->879 880 7ff7bd3cc88c-7ff7bd3cc891 871->880 872->885 875->885 876->852 883 7ff7bd3cc6d6-7ff7bd3cc6d9 877->883 884 7ff7bd3cc759-7ff7bd3cc76b call 7ff7bd3cbbe0 877->884 878->871 887 7ff7bd3cc863-7ff7bd3cc86d 879->887 888 7ff7bd3cc837-7ff7bd3cc83a 879->888 880->840 889 7ff7bd3cc6e4-7ff7bd3cc6f2 883->889 890 7ff7bd3cc6db-7ff7bd3cc6de 883->890 884->885 885->870 894 7ff7bd3cc874-7ff7bd3cc883 887->894 895 7ff7bd3cc86f-7ff7bd3cc872 887->895 892 7ff7bd3cc853-7ff7bd3cc85e call 7ff7bd3c6054 888->892 893 7ff7bd3cc83c-7ff7bd3cc84b 888->893 896 7ff7bd3cc6f4 889->896 897 7ff7bd3cc750-7ff7bd3cc754 889->897 890->878 890->889 892->887 893->892 894->880 895->838 895->894 899 7ff7bd3cc6f8-7ff7bd3cc70f call 7ff7bd3d2b98 896->899 897->869 903 7ff7bd3cc711-7ff7bd3cc71d 899->903 904 7ff7bd3cc747-7ff7bd3cc74d GetLastError 899->904 905 7ff7bd3cc71f-7ff7bd3cc731 call 7ff7bd3d2b98 903->905 906 7ff7bd3cc73c-7ff7bd3cc743 903->906 904->897 905->904 910 7ff7bd3cc733-7ff7bd3cc73a 905->910 906->897 908 7ff7bd3cc745 906->908 908->899 910->906
                                                                              APIs
                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7BD3CC58B), ref: 00007FF7BD3CC6BC
                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7BD3CC58B), ref: 00007FF7BD3CC747
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ConsoleErrorLastMode
                                                                              • String ID:
                                                                              • API String ID: 953036326-0
                                                                              • Opcode ID: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                                                              • Instruction ID: 8514e83ca0e7feb7d6a8aeda6163a5a01d5fa30a26bc67b77cbc0fd8cd58bd02
                                                                              • Opcode Fuzzy Hash: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                                                              • Instruction Fuzzy Hash: A991A236B0C751C5F768AB6984402BDE7A0AB26788F9C413DDF0E57A8AEF38D4418720
                                                                              Function 00007FF7BD3C46F8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 1279662727-0
                                                                              • Opcode ID: f267924f7f97080439486145e1bcefd5e45286d82813a9840df1f1c4553f85a0
                                                                              • Instruction ID: 80aa2333f4c1c823000293213d114e3ea0367026501973fcc005c8456ad276d4
                                                                              • Opcode Fuzzy Hash: f267924f7f97080439486145e1bcefd5e45286d82813a9840df1f1c4553f85a0
                                                                              • Instruction Fuzzy Hash: 36419722E1C782C3E758AB649510369F660FBA6754F549338E76C03ADAEF6CB5E08710
                                                                              Function 00007FF7BD3BA52C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                              • String ID:
                                                                              • API String ID: 3058843127-0
                                                                              • Opcode ID: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                                                              • Instruction ID: 1e848b09286e92d3d617ca55b284786a80e8eef00a26ae849f771588371f352e
                                                                              • Opcode Fuzzy Hash: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                                                              • Instruction Fuzzy Hash: AA313F21A0CA06C6EA5CBB2C95513B9E291AF63784FC4403DF74D4729BFEACA5048738
                                                                              Function 00007FF7BD3C89F8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                              Download Yara Rule

                                                                              Control-flow Graph

                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Process$CurrentExitTerminate
                                                                              • String ID:
                                                                              • API String ID: 1703294689-0
                                                                              • Opcode ID: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                                                              • Instruction ID: 8d9f7445b4ce7dc7d6ce0dda79984bb52ccd80f9e184eefc238529967e8f1dfa
                                                                              • Opcode Fuzzy Hash: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                                                              • Instruction Fuzzy Hash: 62D01714B0C702D2EA5C3B395965138D2111F7A700B84143CCA0F033ABED2DA54D4730
                                                                              Function 00007FF7BD3BE70C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                              • Instruction ID: 7df5a9fff5deb558690805e68ba1cbeea62d22569525da985e871d3600cffd1e
                                                                              • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                              • Instruction Fuzzy Hash: 7151B921A0D641C5E66CAA2D9800679F691EF52B64F984638FF7D577CFEE3CE4408720
                                                                              Function 00007FF7BD3CC058 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastWrite
                                                                              • String ID:
                                                                              • API String ID: 442123175-0
                                                                              • Opcode ID: d35954f5888671c4b8e9d3f715c627a4543e92b38a07bde94bce825eac47ac6c
                                                                              • Instruction ID: a0a772bbb6b8b12033d9f40eccec9c83653630167b39addbc967f07420be4132
                                                                              • Opcode Fuzzy Hash: d35954f5888671c4b8e9d3f715c627a4543e92b38a07bde94bce825eac47ac6c
                                                                              • Instruction Fuzzy Hash: A031D436A1CB85DADB54AF19E4402A9F760FB69780F884039EB4D8375AEF3CD455CB10
                                                                              Function 00007FF7BD3CBA58 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileHandleType
                                                                              • String ID:
                                                                              • API String ID: 3000768030-0
                                                                              • Opcode ID: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                                                              • Instruction ID: 3e3b262315d10a1a55d30cef7d7bb90a9c2c315e0a3e93c011051081e756ead2
                                                                              • Opcode Fuzzy Hash: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                                                              • Instruction Fuzzy Hash: 51316321A1CB46C1DB689B1C8590179E650EB56BB0FAC032DDBAE073E9DF7DE491D310
                                                                              Function 00007FF7BD3CB774 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7BD3CB760,00000000,?,?,?,00007FF7BD3B1023,00007FF7BD3CB869), ref: 00007FF7BD3CB7C0
                                                                              • GetLastError.KERNEL32(?,?,?,?,?,00007FF7BD3CB760,00000000,?,?,?,00007FF7BD3B1023,00007FF7BD3CB869), ref: 00007FF7BD3CB7CA
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastPointer
                                                                              • String ID:
                                                                              • API String ID: 2976181284-0
                                                                              • Opcode ID: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                                                              • Instruction ID: d8f7600a7ce32ff25557009afb2b1e5f9e90fa3b24686f7a5ba1b4caff019032
                                                                              • Opcode Fuzzy Hash: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                                                              • Instruction Fuzzy Hash: 4F11C46171CB81C1DA54AB29A814069E761AB66BF4F984339EF7D077EEEE3CD0948700
                                                                              Function 00007FF7BD3CA198 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF7BD3CA015,?,?,00000000,00007FF7BD3CA0CA), ref: 00007FF7BD3CA206
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3CA015,?,?,00000000,00007FF7BD3CA0CA), ref: 00007FF7BD3CA210
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CloseErrorHandleLast
                                                                              • String ID:
                                                                              • API String ID: 918212764-0
                                                                              • Opcode ID: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                                                              • Instruction ID: 94a8bfa16f3a610a5fcb2c02a72d0e389d35d6ea297f3f4b8303a28699186b1e
                                                                              • Opcode Fuzzy Hash: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                                                              • Instruction Fuzzy Hash: 3D21C211F0C742C1EE68775898A0379D1919FA67A0F8C423DDF2E473DBEE6CA4848324
                                                                              Function 00007FF7BD3CB4EC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 8f779a44aa3b0a3f4ccf073f5887973493dec229e4be6da509badb23d6131534
                                                                              • Instruction ID: f864e123c879d6212f0de0000b889d07b22aa495a481d8581d6b2c7ad2725250
                                                                              • Opcode Fuzzy Hash: 8f779a44aa3b0a3f4ccf073f5887973493dec229e4be6da509badb23d6131534
                                                                              • Instruction Fuzzy Hash: 6141B13290C341C3EA28AB1DE550279F3A0EB77785F980139D78A4369AEF2DE452C770
                                                                              Function 00007FF7BD3B6370 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _fread_nolock
                                                                              • String ID:
                                                                              • API String ID: 840049012-0
                                                                              • Opcode ID: b2dfcc5e9e9a4df627897d8805f43cf7818036fed7bf937ffc55c7782f5abc16
                                                                              • Instruction ID: 8c134236b7549a175959a87fff95f7e4efc147e065a3dc9f43c3d1523a01fea5
                                                                              • Opcode Fuzzy Hash: b2dfcc5e9e9a4df627897d8805f43cf7818036fed7bf937ffc55c7782f5abc16
                                                                              • Instruction Fuzzy Hash: 96216121B0C69285EA59AB1A69043BAF651BF56BD4FC85435EF4D0B78BEE3CE0418710
                                                                              Function 00007FF7BD3CAF7C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                                                              • Instruction ID: da99ae3c5094f18c32371a127a52da57c5ee026e545c045b906db27c012275d2
                                                                              • Opcode Fuzzy Hash: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                                                              • Instruction Fuzzy Hash: 3A319062A1C722C1E6197B69984137CEA50AB62B50FC9013DEB1D133DBEF7CE4818730
                                                                              Function 00007FF7BD3C8929 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                              • String ID:
                                                                              • API String ID: 3947729631-0
                                                                              • Opcode ID: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                                                              • Instruction ID: c4091e5f4d0e6922c94ae27b589d3c8e13dbc13b0f702dc47ef4de7438e10ad3
                                                                              • Opcode Fuzzy Hash: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                                                              • Instruction Fuzzy Hash: 4A21A631A08701D9EB1CAF68C4402FCB7A0EB15318F481639D76D47ADAEF38D685C761
                                                                              Function 00007FF7BD3C5548 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                              • Instruction ID: 3ad7a4d83fb595b817a0ea37005c77b075d8e4bc8c6d594f0435c154bbb9a820
                                                                              • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                              • Instruction Fuzzy Hash: CD115E22A0D741C1EA68BF59940027DE660BFA7B80F8C4439EB4C5779BEE3DE4408720
                                                                              Function 00007FF7BD3D57EC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                                                              • Instruction ID: 74628f5b9ad3b56525e40a76cef617878b4049ca4853c56d075e9c618593c4b9
                                                                              • Opcode Fuzzy Hash: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                                                              • Instruction Fuzzy Hash: D521A432A0C641C7D7649F1CD450369FA60FB96B54FA84238D75D476DAEF3DD4008B10
                                                                              Function 00007FF7BD3BE98C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 3215553584-0
                                                                              • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                              • Instruction ID: 921dac09ad7f55a1eff9aea9a94ab918c84925bb4b627e228d6f6644898bffe2
                                                                              • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                              • Instruction Fuzzy Hash: 9F018221A0C74581EA48AB5A9901169F795BBA7FE0B884639EF5C67BDFEE3CE0114310
                                                                              Function 00007FF7BD3B6320 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FF7BD3B6DC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6DFA
                                                                              • LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B6343
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharLibraryLoadMultiWide
                                                                              • String ID:
                                                                              • API String ID: 2592636585-0
                                                                              • Opcode ID: 4bdf6301c84a861bdb536e2334b00053543545dc7c114505350ac69f55b0c6e6
                                                                              • Instruction ID: 10ea2c233890a92ad9f22b0a9fa1925a8c0bc2fe49a67246bf42270eeb1e9219
                                                                              • Opcode Fuzzy Hash: 4bdf6301c84a861bdb536e2334b00053543545dc7c114505350ac69f55b0c6e6
                                                                              • Instruction Fuzzy Hash: 0AE08611B1818682DA5CA76BF91556AE251EF59BC0B889039EF0D4775BED2CD4908B04
                                                                              Function 00007FFDFB1A2B58 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Free
                                                                              • String ID:
                                                                              • API String ID: 3978063606-0
                                                                              • Opcode ID: 99c7829f09a5c78c67ae0b713d3d91cb04d237d0367d97be12d496e7a1f6d673
                                                                              • Instruction ID: 1146ded9445bb3ec7ab4a40ba2633cde10cf032c33519bc7a1534412fc9b60cf
                                                                              • Opcode Fuzzy Hash: 99c7829f09a5c78c67ae0b713d3d91cb04d237d0367d97be12d496e7a1f6d673
                                                                              • Instruction Fuzzy Hash: 9EC01226F070038BF7086338C87AA6E12A45F49318F918038E02EC6AE9DD0CA8698B01
                                                                              Function 00007FF7BD3CDEC8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF7BD3CAA26,?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E), ref: 00007FF7BD3CDF1D
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AllocHeap
                                                                              • String ID:
                                                                              • API String ID: 4292702814-0
                                                                              • Opcode ID: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                                                              • Instruction ID: eceb658cadcd62f0e1bdf87788e887ade637e137d5398de205b85939c94484da
                                                                              • Opcode Fuzzy Hash: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                                                              • Instruction Fuzzy Hash: E6F03755B0D307C0FE5C776AA9602B5E2906F76B80F8C5439EA0E8769BFE2CE4814330
                                                                              Function 00007FF7BD3CCC3C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF7BD3BF1F4,?,?,?,00007FF7BD3C0706,?,?,?,?,?,00007FF7BD3C276D), ref: 00007FF7BD3CCC7A
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AllocHeap
                                                                              • String ID:
                                                                              • API String ID: 4292702814-0
                                                                              • Opcode ID: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                                                              • Instruction ID: eb71ee05c0d57079bfb00c791d1ffbcfc5328c73ed70d3d1ad13473dcc92341f
                                                                              • Opcode Fuzzy Hash: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                                                              • Instruction Fuzzy Hash: D0F03A69A0D346C4FE2C77795950279D2805FA67A0F8C86389A2E872DBFD2CA4529330

                                                                              Non-executed Functions

                                                                              Function 00007FFDFB354CF0 Relevance: 33.6, APIs: 11, Strings: 8, Instructions: 351stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strspn$strncmp$strcspn
                                                                              • String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Expecting: $Proc-Type:
                                                                              • API String ID: 232339659-387852012
                                                                              • Opcode ID: 42ddd34fbb514b972c3841d9454f420e3ab624245703583627a5e92b4a3d4a41
                                                                              • Instruction ID: 314bf5e938e5c629d7e4e7681daeef04066a901fe424a459015789553ea8ab35
                                                                              • Opcode Fuzzy Hash: 42ddd34fbb514b972c3841d9454f420e3ab624245703583627a5e92b4a3d4a41
                                                                              • Instruction Fuzzy Hash: 06F17E72F0AA4786FB14DB65A560AB927A1BB04788F414031CE6D57AEDEF3CF606C740
                                                                              Function 00007FFDFB1A322E Relevance: 21.3, APIs: 14, Instructions: 251fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide_errno$FileFind$ErrorFirstLastNextfreemallocmemset
                                                                              • String ID:
                                                                              • API String ID: 3372420414-0
                                                                              • Opcode ID: 3d8f240a4f90c780c6746068f38d3319f7b472bfe65928556dd2a935678a57e1
                                                                              • Instruction ID: 8e2a39d2f5862895f9ce58e0b2df146d4079d31a5dc734f697725850a2c90bb7
                                                                              • Opcode Fuzzy Hash: 3d8f240a4f90c780c6746068f38d3319f7b472bfe65928556dd2a935678a57e1
                                                                              • Instruction Fuzzy Hash: 99B1B122B46A83C6EB109F25D464A7C67E4FB45BA8F468735DA6D437E8EF3CD1518300
                                                                              Function 00007FFDFB1A2671 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: EnvironmentVariable$ByteCharMultiWide
                                                                              • String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
                                                                              • API String ID: 2184640988-1666712896
                                                                              • Opcode ID: 9bdffb1b50c3161ebfeb316bcddf5aa0d76d079b0f97c82e6ecc90dc1062e570
                                                                              • Instruction ID: 31eff2b31a8f30854a1562d78dcb244e738cac4994a8cdbb931aa65523485cf4
                                                                              • Opcode Fuzzy Hash: 9bdffb1b50c3161ebfeb316bcddf5aa0d76d079b0f97c82e6ecc90dc1062e570
                                                                              • Instruction Fuzzy Hash: 5661DB22B09B934AEB159F25D96097967E6FF45BA8B444231DE7D43BE8DF3DE0098300
                                                                              Function 00007FF7BD3B58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B5977
                                                                              • GetCurrentProcessId.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B597D
                                                                                • Part of subcall function 00007FF7BD3B5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7BD3B2817,?,?,?,?,?,?), ref: 00007FF7BD3B5B2A
                                                                                • Part of subcall function 00007FF7BD3B5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B5B47
                                                                                • Part of subcall function 00007FF7BD3C6828: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3C6841
                                                                              • SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B5A31
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                              • API String ID: 1556224225-1116378104
                                                                              • Opcode ID: d9ed24271a3d1c9d9675edf7404b1264d8195ad00974861240995d31d7993455
                                                                              • Instruction ID: 2879302f61b62613c469c61e037d04f7869bf1581f5f94fbf05ca48e661793fe
                                                                              • Opcode Fuzzy Hash: d9ed24271a3d1c9d9675edf7404b1264d8195ad00974861240995d31d7993455
                                                                              • Instruction Fuzzy Hash: 1A516E11B1D65381FA9DB72AA8512B9E6515F6BBC0FC85038EF0E5B69BFD2CE4018720
                                                                              Function 00007FFDFB1A5A24 Relevance: 13.6, APIs: 9, Instructions: 73COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 313767242-0
                                                                              • Opcode ID: a2d914222e0312e5cf461600ac8b059d6c61fa3806f1dd2a9609d900ee9212fe
                                                                              • Instruction ID: 1d69fe359a50610ef0d0f7d8138717b7e56ea7f14cd7aa19830ac7d0f666d8bb
                                                                              • Opcode Fuzzy Hash: a2d914222e0312e5cf461600ac8b059d6c61fa3806f1dd2a9609d900ee9212fe
                                                                              • Instruction Fuzzy Hash: 0D313272B0AB8286EB609F60E8607ED7364FB94748F44443ADA5E47BE9DF38D548C710
                                                                              Function 00007FFE148E1A30 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740691190.00007FFE148E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740628690.00007FFE148E0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740718938.00007FFE148E2000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740772023.00007FFE148E3000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740797470.00007FFE148E4000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe148e0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 313767242-0
                                                                              • Opcode ID: 7af6d3e7f7e34c059537e11f5101d55855401e4335d46a65a440c931bdec65b4
                                                                              • Instruction ID: 25b38a270ecfec644f511d091599fb7bd765f7ea5bbbcc572a3f1e5d83220398
                                                                              • Opcode Fuzzy Hash: 7af6d3e7f7e34c059537e11f5101d55855401e4335d46a65a440c931bdec65b4
                                                                              • Instruction Fuzzy Hash: 33314C72609E818AEB609F61E8807EDB361FB85754F44447AEA4D57BA4DF38D64CC700
                                                                              Function 00007FFE11EC0238 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 313767242-0
                                                                              • Opcode ID: f917ff8333d386f8a0a80f5860abe6176b111c19f843e3b6836ed2e39eb9178d
                                                                              • Instruction ID: f65d6ea98ba0af1a2403d0885b44e251b6420678d60b2beab69a1933074595c5
                                                                              • Opcode Fuzzy Hash: f917ff8333d386f8a0a80f5860abe6176b111c19f843e3b6836ed2e39eb9178d
                                                                              • Instruction Fuzzy Hash: C0316F76609E8286EB608FA5EC403EE7769FB84764F40443ADA4E47BA9DF3CD548C710
                                                                              Function 00007FFE13304570 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 313767242-0
                                                                              • Opcode ID: 7a4736268932c74a693b3e5a833589d54eed0b055916a83f70a1c8991e9e4dcb
                                                                              • Instruction ID: 81c2764fd0aca090884e09c90d8fb94908a37a083bbc558e9660d1afd968c1ae
                                                                              • Opcode Fuzzy Hash: 7a4736268932c74a693b3e5a833589d54eed0b055916a83f70a1c8991e9e4dcb
                                                                              • Instruction Fuzzy Hash: 68319272609F8189EB609F61E8403ED3360FB94754F44413ADA5D67BA8DF3CC648CB14
                                                                              Function 00007FF7BD3BAA3C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 3140674995-0
                                                                              • Opcode ID: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                                                              • Instruction ID: 0eac65721541c133260d158ed231f03ab8d088e641c7aa6c542a2b639c9bb498
                                                                              • Opcode Fuzzy Hash: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                                                              • Instruction Fuzzy Hash: CA318F72608A81CAEB649F64E8503E9B360FB65704F84403DDB4D43B99EF7CC208CB24
                                                                              Function 00007FF7BD3D4EB0 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D4EF5
                                                                                • Part of subcall function 00007FF7BD3D4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D485C
                                                                                • Part of subcall function 00007FF7BD3C9F88: HeapFree.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                                • Part of subcall function 00007FF7BD3C9F40: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7BD3C9F1F,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3C9F49
                                                                                • Part of subcall function 00007FF7BD3C9F40: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7BD3C9F1F,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3C9F6E
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D4EE4
                                                                                • Part of subcall function 00007FF7BD3D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D48BC
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D515A
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D516B
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D517C
                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7BD3D53BC), ref: 00007FF7BD3D51A3
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                              • String ID:
                                                                              • API String ID: 4070488512-0
                                                                              • Opcode ID: 694ad2a23735cc7fb3f2ec8971a6aa60c063a628b57b9edeeabbe946f82a905d
                                                                              • Instruction ID: 76071ce308c92680174e936acf4efdca744feb708df7ca26c9ca378d5590d59f
                                                                              • Opcode Fuzzy Hash: 694ad2a23735cc7fb3f2ec8971a6aa60c063a628b57b9edeeabbe946f82a905d
                                                                              • Instruction Fuzzy Hash: 04D19026E0C242C6EB68BF29D4601B9E751EB66784F844139EB4D4769FFF3CE4418B60
                                                                              Function 00007FF7BD3C9C54 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                              • String ID:
                                                                              • API String ID: 1239891234-0
                                                                              • Opcode ID: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                                                              • Instruction ID: 23d136b3c591e737ceb4b0867e5d7f745a7fc403f2b42e10ec33473c45527440
                                                                              • Opcode Fuzzy Hash: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                                                              • Instruction Fuzzy Hash: DC316232608F81C6DB64DB29E8502ADB3A4FB95754F940139EB9D43B5AEF3CC545CB10
                                                                              Function 00007FF7BD3D0A44 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                              • String ID:
                                                                              • API String ID: 2227656907-0
                                                                              • Opcode ID: 8a0645f7c53ed7709a047ca8b2fddc0db645f6da8a23fcc325910753c37d0ffe
                                                                              • Instruction ID: f0b33024d9b522623ecdda39b7fb5b1315b2b0e6bb01df6fdcaf477485176253
                                                                              • Opcode Fuzzy Hash: 8a0645f7c53ed7709a047ca8b2fddc0db645f6da8a23fcc325910753c37d0ffe
                                                                              • Instruction Fuzzy Hash: 66B1CC22B1D64AC1EA68AB29D4201B9E350EB66FD4F845139EF5D077CEEE7CE441C720
                                                                              Function 00007FFDFB1A22E8 Relevance: 6.4, APIs: 5, Instructions: 140COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmove$memset
                                                                              • String ID:
                                                                              • API String ID: 3790616698-0
                                                                              • Opcode ID: 093f8d80f515eaee4f0976beeb406aa8df2a8c5bb98ba842fea8dd7f9a606363
                                                                              • Instruction ID: 4e90520ca7bb2a632c4de6e6c0ba49ff408d039563ad340e8a09ec0b0934eba6
                                                                              • Opcode Fuzzy Hash: 093f8d80f515eaee4f0976beeb406aa8df2a8c5bb98ba842fea8dd7f9a606363
                                                                              • Instruction Fuzzy Hash: 3951E332B1EB86C2DB10DB15E45066EABA4FB49B94F444135EEAD077E9CE3CD105C700
                                                                              Function 00007FF7BD3D512C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D515A
                                                                                • Part of subcall function 00007FF7BD3D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D48BC
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D516B
                                                                                • Part of subcall function 00007FF7BD3D4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D485C
                                                                              • _get_daylight.LIBCMT ref: 00007FF7BD3D517C
                                                                                • Part of subcall function 00007FF7BD3D4878: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3D488C
                                                                                • Part of subcall function 00007FF7BD3C9F88: HeapFree.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7BD3D53BC), ref: 00007FF7BD3D51A3
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                              • String ID:
                                                                              • API String ID: 3458911817-0
                                                                              • Opcode ID: aa908a3e8f59a2679ecf24881337d3af3797adb0d4fc4d825233bf145dabf6f9
                                                                              • Instruction ID: 01b8db909708d385df8fc9d698bb0496eb16ee311fbb955f6a634f2448fb0fc3
                                                                              • Opcode Fuzzy Hash: aa908a3e8f59a2679ecf24881337d3af3797adb0d4fc4d825233bf145dabf6f9
                                                                              • Instruction Fuzzy Hash: 24517622A0C642C6E758FF29E5901A9E750BB6A784FC4513DEB4D4369BEF3CE4008B60
                                                                              Function 00007FFDFB1A2B62 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLastbind
                                                                              • String ID: ..\s\crypto\bio\b_sock2.c
                                                                              • API String ID: 2328862993-3200932406
                                                                              • Opcode ID: 769c29d007f33f69811d41728ff054719c46503b891464c8ad49b5064c10f0e6
                                                                              • Instruction ID: b3baaf7506c18f723691533905af9d716ca1234243cd866b3dddf9db8115788f
                                                                              • Opcode Fuzzy Hash: 769c29d007f33f69811d41728ff054719c46503b891464c8ad49b5064c10f0e6
                                                                              • Instruction Fuzzy Hash: D7219D32F0A25386E710DB25E920AAD77A0EB81B88F404131EA6C47BEDDF3DE5558B40
                                                                              Function 00007FFDFB1A4246 Relevance: .0, Instructions: 33COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: a46b17bfff405d911cbf0ed16f10332b4be66aad2a683c4b6cb6413eca26ac33
                                                                              • Instruction ID: 3034934b09d58a0f83ea6a0d8633b04cc6c4a493c969781e60f78700529a0210
                                                                              • Opcode Fuzzy Hash: a46b17bfff405d911cbf0ed16f10332b4be66aad2a683c4b6cb6413eca26ac33
                                                                              • Instruction Fuzzy Hash: 5FF0E9327283E145C795CA36A408F592DD59391BC8F16C030DA0DC3F59E92EC5018B40
                                                                              Function 00007FFDFB1A5731 Relevance: .0, Instructions: 22COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 47cb47f2231c500fe69675262d211844ffd3893697c7c00b0061ec7b87a542e7
                                                                              • Instruction ID: 443367fc066b6b07e8b46954733c218ddd65d2b6729f2e2c5a3644ed3b6f3cef
                                                                              • Opcode Fuzzy Hash: 47cb47f2231c500fe69675262d211844ffd3893697c7c00b0061ec7b87a542e7
                                                                              • Instruction Fuzzy Hash: 6DE0DF727193A505C796CA336118E692A90A716B89F43C0309A0EC3B99EC2EC601CB40
                                                                              Function 00007FF7BD3B2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F36
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F75
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2F9A
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2FBF
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B2FE7
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B300F
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B3037
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B305F
                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF7BD3B22DE,?,?,?,?), ref: 00007FF7BD3B3087
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressProc
                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                              • API String ID: 190572456-3109299426
                                                                              • Opcode ID: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                                                              • Instruction ID: 701580494b77783a8a6760936e13967aa9aa2bdad5c922e1fa9ccedb97e52912
                                                                              • Opcode Fuzzy Hash: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                                                              • Instruction Fuzzy Hash: E942A665A0DB03D1EA5DBB0CF960174E2A1AF7A780BC4513DDA1E0726EFF7CA5489720
                                                                              Function 00007FF7BD3B50B0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressProc
                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                              • API String ID: 190572456-2208601799
                                                                              • Opcode ID: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                                                              • Instruction ID: 69d35b04fdef8627c6349b3cc8a0e513b09fe4dd7d761d5941f657da2b768c6b
                                                                              • Opcode Fuzzy Hash: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                                                              • Instruction Fuzzy Hash: 51E1C565A5DB07D0EE0DBB0CA960174E2A1AF3A780BD8513DDB0D0726EFF7CA5489724
                                                                              Function 00007FFE11EB5650 Relevance: 73.9, APIs: 37, Strings: 5, Instructions: 356COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocDecodeDict_ItemUnicode_$Err_Occurred$CallErrorObject_With$BuildList_Tuple_Value
                                                                              • String ID: (NN)$CharacterData$D:\a\1\s\Modules\pyexpat.c$StartElement$strict
                                                                              • API String ID: 1108465364-2450736762
                                                                              • Opcode ID: ec1538620baa8ccbbed54320d37762024d44c978dd331c21885a558486103a2e
                                                                              • Instruction ID: 6b0a4e1648f6cee860728bcce58b9fb7642ff89f6054ec459e1b6089ce4959fe
                                                                              • Opcode Fuzzy Hash: ec1538620baa8ccbbed54320d37762024d44c978dd331c21885a558486103a2e
                                                                              • Instruction Fuzzy Hash: EFF13335A09E4382EB658FA3AC4427B63A8BF45FB0F4850B2DA4E067B0DE3CF4458704
                                                                              Function 00007FFE11EB1000 Relevance: 59.7, APIs: 17, Strings: 17, Instructions: 171COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyModule_GetState.PYTHON311 ref: 00007FFE11EB100D
                                                                              • PyUnicode_InternFromString.PYTHON311 ref: 00007FFE11EB101D
                                                                              • PyType_FromModuleAndSpec.PYTHON311 ref: 00007FFE11EB103D
                                                                                • Part of subcall function 00007FFE11EB1420: PyDescr_NewGetSet.PYTHON311(?,?,?,00007FFE11EB1057), ref: 00007FFE11EB1488
                                                                                • Part of subcall function 00007FFE11EB1420: PyDict_SetDefault.PYTHON311(?,?,?,00007FFE11EB1057), ref: 00007FFE11EB14A7
                                                                              • PyErr_NewException.PYTHON311 ref: 00007FFE11EB106B
                                                                              • PyModule_AddObjectRef.PYTHON311 ref: 00007FFE11EB108B
                                                                              • PyModule_AddObjectRef.PYTHON311 ref: 00007FFE11EB10A7
                                                                              • PyModule_AddObjectRef.PYTHON311 ref: 00007FFE11EB10C2
                                                                              • PyModule_AddStringConstant.PYTHON311 ref: 00007FFE11EB10E1
                                                                              • Py_BuildValue.PYTHON311 ref: 00007FFE11EB1101
                                                                              • PyModule_AddObject.PYTHON311 ref: 00007FFE11EB1117
                                                                              • PyModule_AddStringConstant.PYTHON311 ref: 00007FFE11EB1136
                                                                                • Part of subcall function 00007FFE11EB1A9C: PyDict_New.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1ACD
                                                                                • Part of subcall function 00007FFE11EB1A9C: PyDict_New.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1AD6
                                                                                • Part of subcall function 00007FFE11EB1A9C: PyModule_AddStringConstant.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B37
                                                                                • Part of subcall function 00007FFE11EB1A9C: PyModule_AddObject.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B55
                                                                                • Part of subcall function 00007FFE11EB1A9C: PyModule_AddObject.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B7D
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddStringConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB15DD
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB15F9
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1615
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1631
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB164D
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1669
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1685
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB169C
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16B4
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16CC
                                                                                • Part of subcall function 00007FFE11EB15A8: PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16E4
                                                                                • Part of subcall function 00007FFE11EB1354: PyList_New.PYTHON311(?,?,00000000,00007FFE11EB116C), ref: 00007FFE11EB1371
                                                                                • Part of subcall function 00007FFE11EB1354: Py_BuildValue.PYTHON311(?,?,00000000,00007FFE11EB116C), ref: 00007FFE11EB139F
                                                                                • Part of subcall function 00007FFE11EB1354: PyList_Append.PYTHON311(?,?,00000000,00007FFE11EB116C), ref: 00007FFE11EB13B7
                                                                                • Part of subcall function 00007FFE11EB1354: PyModule_AddObject.PYTHON311(?,?,00000000,00007FFE11EB116C), ref: 00007FFE11EB13F0
                                                                              • PyModule_AddIntConstant.PYTHON311 ref: 00007FFE11EB1181
                                                                              • PyModule_AddIntConstant.PYTHON311 ref: 00007FFE11EB119F
                                                                              • PyModule_AddIntConstant.PYTHON311 ref: 00007FFE11EB11BD
                                                                              • PyCapsule_New.PYTHON311 ref: 00007FFE11EB1319
                                                                              • PyModule_AddObject.PYTHON311 ref: 00007FFE11EB1334
                                                                              • _Py_Dealloc.PYTHON311 ref: 00007FFE11EC087D
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_$Constant$Object$String$Dict_$BuildFromList_Value$AppendCapsule_DeallocDefaultDescr_Err_ExceptionInternModuleSpecStateType_Unicode_
                                                                              • String ID: (iii)$EXPAT_VERSION$ExpatError$UTF-8$XMLParserType$XML_PARAM_ENTITY_PARSING_ALWAYS$XML_PARAM_ENTITY_PARSING_NEVER$XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE$error$expat_2.5.0$expat_CAPI$native_encoding$pyexpat.expat_CAPI$pyexpat.expat_CAPI 1.1$read$version_info$xml.parsers.expat.ExpatError
                                                                              • API String ID: 235282681-1039362492
                                                                              • Opcode ID: 0d2f8b653efa714e59c4df950fb5ca91b7968f6d6ff7bf994debafffa61f2783
                                                                              • Instruction ID: 8ca4943924843608f26eaf62135aa829c70df3cf1d050f5bbe6ce5933531abe0
                                                                              • Opcode Fuzzy Hash: 0d2f8b653efa714e59c4df950fb5ca91b7968f6d6ff7bf994debafffa61f2783
                                                                              • Instruction Fuzzy Hash: FF918024A0AF0395EB019BA7FD502AB23ADBF457B4F4461B6C90D427B0EF3EE1198354
                                                                              Function 00007FFE1A458EE4 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
                                                                              • API String ID: 2943138195-1482988683
                                                                              • Opcode ID: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
                                                                              • Instruction ID: 7dbdcc0aec0229bd67dc74b7a8b344ddb4082a3b9b28ae3fc64f9eee612ad8f4
                                                                              • Opcode Fuzzy Hash: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
                                                                              • Instruction Fuzzy Hash: 8D0281B6F08E1294FB14EB66D8941BC27B0BB0AB64F5441F7DA0D52AB9DF3CA564C340
                                                                              Function 00007FFDFB3541F0 Relevance: 49.7, APIs: 19, Strings: 14, Instructions: 223stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354241
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354258
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB35426F
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3542A2
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3542EB
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB35431F
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354371
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354384
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB35439B
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3543AE
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3543C5
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3543D8
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3543EF
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354402
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354415
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354428
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB35443B
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB354487
                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB354E33,?,?,?,?,?,?,?,?,00007FFDFB352E4B), ref: 00007FFDFB3544B2
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strcmp
                                                                              • String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
                                                                              • API String ID: 1004003707-1119032718
                                                                              • Opcode ID: 5faaf54baf5283146832f0d94d5468780e9adc20c66d13194ea508598b332b28
                                                                              • Instruction ID: 7cbc1fd0439f93f08adbf8878ed6ef511716744a8dac1ef1443cdf87db9aca02
                                                                              • Opcode Fuzzy Hash: 5faaf54baf5283146832f0d94d5468780e9adc20c66d13194ea508598b332b28
                                                                              • Instruction Fuzzy Hash: 3E91EF61BCE65742FF58A7269A70A7826D19F45B88F462131D97E822FEEF1CF4068300
                                                                              Function 00007FFE11EBCAD0 Relevance: 44.0, APIs: 17, Strings: 8, Instructions: 277COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Arg_Object_SizeUnicode_$ArgumentDict_Err_KeywordsMallocMem_Module_StateStringTrackUnpack
                                                                              • String ID: ParserCreate$XML_ParserCreate failed$argument 'encoding'$argument 'namespace_separator'$embedded null character$intern must be a dictionary$namespace_separator must be at most one character, omitted, or None$str or None
                                                                              • API String ID: 2842625026-809047262
                                                                              • Opcode ID: 9de47e51edb65ea99209e14fea0ba0e77745f753954ab8dae8a519e15648c6aa
                                                                              • Instruction ID: 0be57a4ae5de4f5ebe77e0c702be83b3651a58dba96532799df6a841617b5d33
                                                                              • Opcode Fuzzy Hash: 9de47e51edb65ea99209e14fea0ba0e77745f753954ab8dae8a519e15648c6aa
                                                                              • Instruction Fuzzy Hash: 9AC13426A0DF4282EF658B96EC8027A67A8FF45BB0F5451B6DA1E077B0DF3CE4558700
                                                                              Function 00007FFE11EB5421 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 209COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$CallDecodeDict_Err_ItemObject_OccurredUnicode_$BuildErrorTraceback_Tuple_ValueWith
                                                                              • String ID: (N)$CharacterData$D:\a\1\s\Modules\pyexpat.c$EndElement$strict
                                                                              • API String ID: 2795322658-1455353876
                                                                              • Opcode ID: 7b35b030cee3a01824993ae3c3782c2dba0e933724c7249c1410480d19b91b92
                                                                              • Instruction ID: a646c05a783d438abda6cb36d27b53dd8703f12be80bcc6049b3cc653282c353
                                                                              • Opcode Fuzzy Hash: 7b35b030cee3a01824993ae3c3782c2dba0e933724c7249c1410480d19b91b92
                                                                              • Instruction Fuzzy Hash: 73913731A09E4386EB658FA7ED4427A63A9FF49BB0F4850B5CA4E46774DF3DE4458300
                                                                              Function 00007FFE11EB15A8 Relevance: 42.1, APIs: 11, Strings: 13, Instructions: 82COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE11EB1504: strrchr.VCRUNTIME140(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1526
                                                                                • Part of subcall function 00007FFE11EB1504: PyModule_New.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1532
                                                                                • Part of subcall function 00007FFE11EB1504: PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1543
                                                                                • Part of subcall function 00007FFE11EB1504: _PyImport_SetModule.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB155B
                                                                                • Part of subcall function 00007FFE11EB1504: PyModule_AddObject.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB157D
                                                                              • PyModule_AddStringConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB15DD
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB15F9
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1615
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1631
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB164D
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1669
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB1685
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB169C
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16B4
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16CC
                                                                              • PyModule_AddIntConstant.PYTHON311(?,?,00000000,00007FFE11EB115C), ref: 00007FFE11EB16E4
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_$Constant$String$FromImport_ModuleObjectUnicode_strrchr
                                                                              • String ID: Constants used to interpret content model information.$XML_CQUANT_NONE$XML_CQUANT_OPT$XML_CQUANT_PLUS$XML_CQUANT_REP$XML_CTYPE_ANY$XML_CTYPE_CHOICE$XML_CTYPE_EMPTY$XML_CTYPE_MIXED$XML_CTYPE_NAME$XML_CTYPE_SEQ$__doc__$pyexpat.model
                                                                              • API String ID: 3546453425-788580754
                                                                              • Opcode ID: 6f809eb47c2d32f2b44fb7ca14c0080896cc1be493fd68ee0d64ff1e60cc6176
                                                                              • Instruction ID: 6ba055c7965f9d072ae30080c888bf4a8f7b9793e3547f06ac9b93136daca91f
                                                                              • Opcode Fuzzy Hash: 6f809eb47c2d32f2b44fb7ca14c0080896cc1be493fd68ee0d64ff1e60cc6176
                                                                              • Instruction Fuzzy Hash: 2F314524B1CD5392EB148FA3ED501A7236DBF00BB5B84A172C96D86574DF6DF909C710
                                                                              Function 00007FFE13305568 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 148COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ReadyUnicode_$Arg_Bool_CheckFromLongPositional
                                                                              • String ID: Buffer must be single dimension$compare_digest$comparing strings with non-ASCII characters is not supported$unsupported operand types(s) or combination of types: '%.100s' and '%.100s'
                                                                              • API String ID: 960716163-2538118963
                                                                              • Opcode ID: fb16102ad7aedabbae2b720364eef6ebaee46cbfe74884b07019a587325ceb3c
                                                                              • Instruction ID: d9182b26bbe81dc5205f0afe3f0e5a84177ddce808d1c73d159c84dc49addaec
                                                                              • Opcode Fuzzy Hash: fb16102ad7aedabbae2b720364eef6ebaee46cbfe74884b07019a587325ceb3c
                                                                              • Instruction Fuzzy Hash: AF61AE61A0CE46CAFB208B27E45427D23A0FFA4BA4F5451B1DA6E676F4DF2CE445C708
                                                                              Function 00007FFDFB1A1B77 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 204stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strspn$strncmp
                                                                              • String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
                                                                              • API String ID: 1384302209-3505811795
                                                                              • Opcode ID: 1b869f1a6eac8aeb398c7f487eda61ac9ae1a2185d31ed71d5288b5492fc2b28
                                                                              • Instruction ID: 905123f1040e50d07e9ce5430beb8f4f5ecca839b2e6859b98a244e413b5d175
                                                                              • Opcode Fuzzy Hash: 1b869f1a6eac8aeb398c7f487eda61ac9ae1a2185d31ed71d5288b5492fc2b28
                                                                              • Instruction Fuzzy Hash: 5991D061F5EA5796E7209F21A9A09B93790EF00788F404034DA6E476F9EF3CF556C740
                                                                              Function 00007FFE13301650 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 128threadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Buffer_Release$BufferDigestErr_Eval_Object_StringThreadUpdate$CheckRestoreSaveThread_acquire_lockThread_allocate_lockThread_release_lock
                                                                              • String ID: Buffer must be single dimension$Strings must be encoded before hashing$object supporting the buffer API required
                                                                              • API String ID: 3566613315-2943709887
                                                                              • Opcode ID: a1547ea42d92a3772ce6650c4cebde31e608418f5351fa5d4bab7438ae3a001c
                                                                              • Instruction ID: a72c75207f78c1545a26d3462e8e4c3158f20d9a3f221e916952bcf436952847
                                                                              • Opcode Fuzzy Hash: a1547ea42d92a3772ce6650c4cebde31e608418f5351fa5d4bab7438ae3a001c
                                                                              • Instruction Fuzzy Hash: 71514A25B08E428AE7258B27E84423D63A1FBA4FB4F5441B1DD6E63AB4DF3CE4458744
                                                                              Function 00007FFE1A45C78C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 289COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+$Replicator::operator[]
                                                                              • String ID: `anonymous namespace'
                                                                              • API String ID: 3863519203-3062148218
                                                                              • Opcode ID: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
                                                                              • Instruction ID: 6a758915081d58248ca3c32c78a191dc0b8c5a9bcc3ca2fce3e8a3b1add8117b
                                                                              • Opcode Fuzzy Hash: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
                                                                              • Instruction Fuzzy Hash: 89E15AB2B08F8295EB10EF26E4801BC7BA0FB45BA4F5041B6EA5D57B65DF38E564C700
                                                                              Function 00007FFE11EB1A9C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 101COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE11EB1504: strrchr.VCRUNTIME140(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1526
                                                                                • Part of subcall function 00007FFE11EB1504: PyModule_New.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1532
                                                                                • Part of subcall function 00007FFE11EB1504: PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1543
                                                                                • Part of subcall function 00007FFE11EB1504: _PyImport_SetModule.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB155B
                                                                                • Part of subcall function 00007FFE11EB1504: PyModule_AddObject.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB157D
                                                                              • PyDict_New.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1ACD
                                                                              • PyDict_New.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1AD6
                                                                              • PyModule_AddStringConstant.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B37
                                                                              • PyModule_AddObject.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B55
                                                                              • PyModule_AddObject.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1B7D
                                                                                • Part of subcall function 00007FFE11EB1BC0: PyModule_AddStringConstant.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C16
                                                                                • Part of subcall function 00007FFE11EB1BC0: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C26
                                                                                • Part of subcall function 00007FFE11EB1BC0: PyDict_SetItemString.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C3D
                                                                                • Part of subcall function 00007FFE11EB1BC0: PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C4E
                                                                                • Part of subcall function 00007FFE11EB1BC0: PyDict_SetItem.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C69
                                                                              • _Py_Dealloc.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0B66
                                                                              • _Py_Dealloc.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0B82
                                                                              • _Py_Dealloc.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0B91
                                                                              • _Py_Dealloc.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0BA5
                                                                              • _Py_Dealloc.PYTHON311(?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0BB0
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_$DeallocString$Dict_$FromObject$ConstantItemUnicode_$Import_LongLong_Modulestrrchr
                                                                              • String ID: Constants used to describe error conditions.$__doc__$codes$messages$pyexpat.errors
                                                                              • API String ID: 2569741488-1115447882
                                                                              • Opcode ID: c1e41d8709b64e828bdf0e6f325532cf85e1998db5eab65bac950ab610a439a0
                                                                              • Instruction ID: bb001fd6783fca7039b841fecf09ba144d5791e92f5e9c507af096d637716025
                                                                              • Opcode Fuzzy Hash: c1e41d8709b64e828bdf0e6f325532cf85e1998db5eab65bac950ab610a439a0
                                                                              • Instruction Fuzzy Hash: 79410835A08E4381EF189FA3ED5427A67ADBF46BB4F4861B1DA0F426B4DE2CF5518300
                                                                              Function 00007FFE11EB2F20 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 331COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_Long_Occurredmemcpy$Arg_BufferBuffer_FromKeywordsLongModuleObject_ReleaseSizeStateType_Unicode_Unpack
                                                                              • String ID: )$)$utf-8$xml=http://www.w3.org/XML/1998/namespace
                                                                              • API String ID: 3949833915-3008315473
                                                                              • Opcode ID: ef3439f6a5de1ea3a5c19d6bac1bee45308c51c526ee5f09446c2ef53c21038d
                                                                              • Instruction ID: d7915aced36367889b2bb6aa1f4c07a2ce81a182c2bfd0f0cfb5ec568a7421b2
                                                                              • Opcode Fuzzy Hash: ef3439f6a5de1ea3a5c19d6bac1bee45308c51c526ee5f09446c2ef53c21038d
                                                                              • Instruction Fuzzy Hash: 7FE15F76A0DB8682EB618FA29C453AA22ADFF44FA4F544076CE4D477A4DF3CE4808754
                                                                              Function 00007FFDFB1A4E44 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 205registryfileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
                                                                              • String ID: $OpenSSL$OpenSSL: FATAL$no stack?
                                                                              • API String ID: 2603057392-2963566556
                                                                              • Opcode ID: 75131406242315063b9eb8b61f751d263e868ede2efdb133bf2f38d68100ef13
                                                                              • Instruction ID: dc649143297beeeeea613eb550f854a08adf828ff5dcf86a72242b6124115709
                                                                              • Opcode Fuzzy Hash: 75131406242315063b9eb8b61f751d263e868ede2efdb133bf2f38d68100ef13
                                                                              • Instruction Fuzzy Hash: 98910533B09B8391EB209F24D8649AD3764FB45B98F404635EA6D5BBE8EF38E155C300
                                                                              Function 00007FFE1A45D5B0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: NameName::$Name::operator+atolswprintf_s
                                                                              • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
                                                                              • API String ID: 2331677841-2441609178
                                                                              • Opcode ID: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
                                                                              • Instruction ID: a0640689a17bf5f943b04cc540ad424429349c19d9146e0dc1704bca9f803f80
                                                                              • Opcode Fuzzy Hash: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
                                                                              • Instruction Fuzzy Hash: 0DF19FA2F0CE4294FB14FB6685541BC27B1AF44F64F0401F7C98D26AB5DE3CA96AC340
                                                                              Function 00007FF7BD3B6C00 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7BD3B6C3C
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                              • API String ID: 203985260-1562484376
                                                                              • Opcode ID: c6af48c2a72f93560c75fce8b7fe5bee055e0ffe2315a87dca28ecb6449ed662
                                                                              • Instruction ID: a680af05ea21ee1ed3b8fa1f65f83a728125c3a93026b5def0747f8563ad7766
                                                                              • Opcode Fuzzy Hash: c6af48c2a72f93560c75fce8b7fe5bee055e0ffe2315a87dca28ecb6449ed662
                                                                              • Instruction Fuzzy Hash: 5E419461A0DA02C1E618BB19AC5017AF6A1AF667C0FC8453CEB4D4769FFF3CE1418720
                                                                              Function 00007FFE13305B70 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 102COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Buffer_$Arg_$ArgumentBufferContiguousObject_Release$KeywordsUnpack
                                                                              • String ID: argument 'key'$argument 'msg'$contiguous buffer$hmac_digest
                                                                              • API String ID: 3345984100-3409375717
                                                                              • Opcode ID: 5845a12e731993df909c334ade5d379dbbea437c27d36fd20dbefa8c412e903a
                                                                              • Instruction ID: 3652595bbfac9e710dd1ea5e69cb8c4d9a5ff3b09fde23b95081a7e8c003a3d2
                                                                              • Opcode Fuzzy Hash: 5845a12e731993df909c334ade5d379dbbea437c27d36fd20dbefa8c412e903a
                                                                              • Instruction Fuzzy Hash: C2518022A0CF8685FB20CB26E8443BE6360FBB57A8F405171E99D56575DF7CE588C704
                                                                              Function 00007FFDFB1A1C1C Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strcmp$strncmp
                                                                              • String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
                                                                              • API String ID: 1244041713-3630080479
                                                                              • Opcode ID: cb09d76981884f911073ec79770a94529b3f76ec59753b3682a11d1b1a51dff2
                                                                              • Instruction ID: c7289a3164cacd96cc2c9a67f0fc95dd18a98978600e5d0adcc1645f34c271dc
                                                                              • Opcode Fuzzy Hash: cb09d76981884f911073ec79770a94529b3f76ec59753b3682a11d1b1a51dff2
                                                                              • Instruction Fuzzy Hash: 3BC17C62F1E68381FB14EB11A460AB96295AF81B88F448032ED6D4B7EDEF3CF505D700
                                                                              Function 00007FFE11EBD120 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 152stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _errno$getenvstrtoul
                                                                              • String ID: EXPAT_ACCOUNTING_DEBUG$EXPAT_ENTITY_DEBUG
                                                                              • API String ID: 1872403029-3277422050
                                                                              • Opcode ID: 84d1486a463a4cd18aafa05269b5d552b7879547b4fb56850b1ed22286907d38
                                                                              • Instruction ID: 0fbb3047e43239df3a8aecaaea6e390405de3be246ded6c01e9ea916d6cd68df
                                                                              • Opcode Fuzzy Hash: 84d1486a463a4cd18aafa05269b5d552b7879547b4fb56850b1ed22286907d38
                                                                              • Instruction Fuzzy Hash: DB912A72525F91C5E7418F61E84439D33ADFB44F98F58823AEE894BB68DF3890A1C760
                                                                              Function 00007FFDFB1A1F69 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 135COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: ..\s\crypto\rand\randfile.c$Filename=$i
                                                                              • API String ID: 0-1799673945
                                                                              • Opcode ID: a736c0758ac64ed8d8ce1e09c9eb5d692d3ad43bf8a19e6fd3513a6c640bf2e0
                                                                              • Instruction ID: 86979c604b9dae808947768ec813ea30e1ecb1cc1acae56d16a4fb8902bccc32
                                                                              • Opcode Fuzzy Hash: a736c0758ac64ed8d8ce1e09c9eb5d692d3ad43bf8a19e6fd3513a6c640bf2e0
                                                                              • Instruction Fuzzy Hash: 8951A222B0EA538AFB10AB65E860E7A2391EF85B84F400135D96D476EDEF3CF509C700
                                                                              Function 00007FF7BD3B1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                              • API String ID: 0-666925554
                                                                              • Opcode ID: 41c00267e824b168c08840519eb6b49ad12eba3dbed6fe9bea21d766fdc91f50
                                                                              • Instruction ID: 73c0713862583da631b8ef7b2cf8468f5049d922c0cbeb58ca2b56963aed74c1
                                                                              • Opcode Fuzzy Hash: 41c00267e824b168c08840519eb6b49ad12eba3dbed6fe9bea21d766fdc91f50
                                                                              • Instruction Fuzzy Hash: 67519921B0C642C5EA18BB19A5507B9F360AF62BD4F840539EF1D476AFFE3CE1448720
                                                                              Function 00007FF7BD3B6A70 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetCurrentProcess.KERNEL32(00000000,00007FF7BD3B59BA,?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AB0
                                                                              • OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AC1
                                                                              • GetTokenInformation.ADVAPI32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AE3
                                                                              • GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6AED
                                                                              • GetTokenInformation.ADVAPI32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B2A
                                                                              • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7BD3B6B3C
                                                                              • CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B54
                                                                              • LocalFree.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6B86
                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7BD3B6BAD
                                                                              • CreateDirectoryW.KERNEL32(?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B6BBE
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                              • API String ID: 4998090-2855260032
                                                                              • Opcode ID: 91f206f193b68330ebd28d0cb2e5982b23392e5c7638bf7621f932f987ca90f9
                                                                              • Instruction ID: 1ba6a531c45c0faab4739f53c9146d181aeec1f70e831a4f5c9d2ee29371cca4
                                                                              • Opcode Fuzzy Hash: 91f206f193b68330ebd28d0cb2e5982b23392e5c7638bf7621f932f987ca90f9
                                                                              • Instruction Fuzzy Hash: CE41913160C642C2E654EF19E4502AAF361FBA6790F840239FB5E476AAEF7CD448CB10
                                                                              Function 00007FFE1A45AC40 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID:
                                                                              • API String ID: 2943138195-0
                                                                              • Opcode ID: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
                                                                              • Instruction ID: a7aa80316a2878be015e071105aea082f55ffaeb5075f6b9b9b5806ce88fa842
                                                                              • Opcode Fuzzy Hash: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
                                                                              • Instruction Fuzzy Hash: 7CF16DB6B08B829AE711EF66D4901FC37B0EB04B5CB4044B6EA4D57BA9DF38D569C340
                                                                              Function 00007FFE13302760 Relevance: 19.6, APIs: 13, Instructions: 70COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Mem_$Free$X_free$Err_Memory$DigestFinalMallocPy_strhexX_copyX_new
                                                                              • String ID:
                                                                              • API String ID: 422439089-0
                                                                              • Opcode ID: b2ab8a0d7e008b83c2d7629f2e51ae589ec2dfac3e9a1e52696f2ca71d4e8ac7
                                                                              • Instruction ID: 79286bf0bf7bb8bc762e80645f0ad85c904e4c8d98e6fa41c58c1672212293b2
                                                                              • Opcode Fuzzy Hash: b2ab8a0d7e008b83c2d7629f2e51ae589ec2dfac3e9a1e52696f2ca71d4e8ac7
                                                                              • Instruction Fuzzy Hash: E6210E24A0CE4389FA159B23AD5413D6365AFA9FE0B0450B0ED6F67BB5DE3CE0448318
                                                                              Function 00007FFE11EC9410 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 105COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Arg_SizeUnicode_$ArgumentErr_KeywordsStringUnpack
                                                                              • String ID: ExternalEntityParserCreate$argument 1$argument 2$embedded null character$str$str or None
                                                                              • API String ID: 542819765-2847936699
                                                                              • Opcode ID: 85ed71d5f9bd933ff640a86a9dd3fe66ec5ead2380ae7da7a34d43c44726738e
                                                                              • Instruction ID: 852517d838476a289b46b7ef3a798a0b724afdef1d31fcbef8650c59559a175c
                                                                              • Opcode Fuzzy Hash: 85ed71d5f9bd933ff640a86a9dd3fe66ec5ead2380ae7da7a34d43c44726738e
                                                                              • Instruction Fuzzy Hash: 24412E21A08F8695EF608B83EC406A663A8FB54BA4F8551B2ED5D037B4EF3DE545C710
                                                                              Function 00007FFE1A452F14 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 314COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                              • String ID: csm$csm$csm
                                                                              • API String ID: 4223619315-393685449
                                                                              • Opcode ID: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
                                                                              • Instruction ID: e8cc468c752573ce801f211601fbd0435f1f4d5e40cf52f815ae5a79b57f6e2d
                                                                              • Opcode Fuzzy Hash: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
                                                                              • Instruction Fuzzy Hash: DEE150B2B08F4186EB10AB66D4502BD77A4FB45FA8F1401B6EA4D57B69CF38E5A4C700
                                                                              Function 00007FFE1A45E72C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Replicator::operator[]
                                                                              • String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
                                                                              • API String ID: 3676697650-3207858774
                                                                              • Opcode ID: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
                                                                              • Instruction ID: 643e62bf24f5c2b9b99468e577bec5373a6d064ef5e31ed0111f09d99902349a
                                                                              • Opcode Fuzzy Hash: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
                                                                              • Instruction Fuzzy Hash: 5F91ACA2B08E8695FB24EF26D4412B877B1AB44B68F4481F3DA5D036B5DF3CE565C340
                                                                              Function 00007FFE11ECB434 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 104COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: __acrt_iob_func$__stdio_common_vfprintf
                                                                              • String ID: (+%6I64d bytes %s|%d, xmlparse.c:%d) %*s"$DIR$EXP$[..]
                                                                              • API String ID: 2815179470-1851131210
                                                                              • Opcode ID: 3a1ae70cdbf03e82a2f9a2e4278202063ac46a8c3148231cdacc49116479c827
                                                                              • Instruction ID: 9c7b9882619e6f2744aca068bda16a7aaf080ddaba0a3b7a1bc6b1b57e1a55cb
                                                                              • Opcode Fuzzy Hash: 3a1ae70cdbf03e82a2f9a2e4278202063ac46a8c3148231cdacc49116479c827
                                                                              • Instruction Fuzzy Hash: A6415F65E08E8285EF049BA6EC142BA77A9BF497A0F8464B5DA4D07375DF3CF4068B00
                                                                              Function 00007FFE11EB2734 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 86COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$CallDecodeObject_Traceback_Tuple_Unicode_
                                                                              • String ID: CharacterData$D:\a\1\s\Modules\pyexpat.c$strict
                                                                              • API String ID: 1267065021-205442349
                                                                              • Opcode ID: 1526a3ff9da1062465dbc525b4bcc35980f186fe257fc366dd8affedb9d03219
                                                                              • Instruction ID: cb1d64e7f5d07f9b20a906e7e7437444766810f29fc5a73add17c07bfb593111
                                                                              • Opcode Fuzzy Hash: 1526a3ff9da1062465dbc525b4bcc35980f186fe257fc366dd8affedb9d03219
                                                                              • Instruction Fuzzy Hash: 4C415835A09E1386EB188BA2DC4423A22A8FF45FA4F1841B1DA0D07BB4DF2DF5828344
                                                                              Function 00007FFE148E1100 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740691190.00007FFE148E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740628690.00007FFE148E0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740718938.00007FFE148E2000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740772023.00007FFE148E3000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740797470.00007FFE148E4000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe148e0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                              • String ID:
                                                                              • API String ID: 349153199-0
                                                                              • Opcode ID: d573cd7bf0bafa259f49a36843b2703105abc7edda614b8f92858340699d7a94
                                                                              • Instruction ID: 77597de31c131fafda537e2bee4bd31a9131f913a9c72463567c5403aff98f66
                                                                              • Opcode Fuzzy Hash: d573cd7bf0bafa259f49a36843b2703105abc7edda614b8f92858340699d7a94
                                                                              • Instruction Fuzzy Hash: AB819061E0CE4386F650AB6798C12F9E290AF477A0F4441B9FA0C677B6DF2DE84D8600
                                                                              Function 00007FFE11EBF910 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                              • String ID:
                                                                              • API String ID: 349153199-0
                                                                              • Opcode ID: ed0456ed56a28c5e954244ba569a3f5ab9305d27bbb2f4b4d91e80861801ede4
                                                                              • Instruction ID: 792a43f8441a834f10eb752c0b9ace501afb81d7d015713e8dcafd7ace6e4335
                                                                              • Opcode Fuzzy Hash: ed0456ed56a28c5e954244ba569a3f5ab9305d27bbb2f4b4d91e80861801ede4
                                                                              • Instruction Fuzzy Hash: 0C81C321E0CE4346FB549BE79C4127B6698BF457B0F5450B6E90D833B6DE3EE841870A
                                                                              Function 00007FFE13303C40 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                              • String ID:
                                                                              • API String ID: 349153199-0
                                                                              • Opcode ID: 60740118ffc561110092f8fa7fcfca06e5701660f826d2aea51ad36781cacfe9
                                                                              • Instruction ID: c5e916b21fabc8101b9a0aa4641fc76c96260a58bc83d59c2eb34a5316c57663
                                                                              • Opcode Fuzzy Hash: 60740118ffc561110092f8fa7fcfca06e5701660f826d2aea51ad36781cacfe9
                                                                              • Instruction Fuzzy Hash: BA81A021E0CE434EFA50AB6794412BE66A0AF75BB0F4441B5DA6C777B2DF3CE9418708
                                                                              Function 00007FFDFB1A7207 Relevance: 16.7, APIs: 4, Strings: 7, Instructions: 159stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strchr
                                                                              • String ID: ..\s\crypto\ocsp\ocsp_lib.c$/$/$443$[$http$https
                                                                              • API String ID: 2830005266-535551730
                                                                              • Opcode ID: 3f4b0d76255caf907e181389f39ab80ca888ca80cbe07dbd0ebd0c6e25bf62fd
                                                                              • Instruction ID: 2cd41896455bffde1cd32c57371564698dad538185ac17439d5a4a69b7bc63ba
                                                                              • Opcode Fuzzy Hash: 3f4b0d76255caf907e181389f39ab80ca888ca80cbe07dbd0ebd0c6e25bf62fd
                                                                              • Instruction Fuzzy Hash: B561A062B0AB47C5FB51EB11E920A7927A0AF45B88F444036DD6D0B7EDEE3DE649C700
                                                                              Function 00007FFDFB1A32B0 Relevance: 16.6, APIs: 5, Strings: 6, Instructions: 127stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: atoi$strcmp
                                                                              • String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
                                                                              • API String ID: 4175852868-1596076588
                                                                              • Opcode ID: 7fedaee5a43b9f96133ba3337b9998908fec395ca8a45f4228c1692c16d9240c
                                                                              • Instruction ID: 7a67a9be9151b202da89f1865efef95a0ea5e9224899cfa27d96b56d1ead318d
                                                                              • Opcode Fuzzy Hash: 7fedaee5a43b9f96133ba3337b9998908fec395ca8a45f4228c1692c16d9240c
                                                                              • Instruction Fuzzy Hash: 1C519262F0A60796EB04AB25A9209B973D6BF44B8CF404535DD2E477F9DE3CF5098340
                                                                              Function 00007FFE1A45A4E8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
                                                                              • API String ID: 2943138195-1464470183
                                                                              • Opcode ID: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
                                                                              • Instruction ID: 90fb06028247f6d77425227131e51550878adda126d9450814a8a4ab99568be3
                                                                              • Opcode Fuzzy Hash: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
                                                                              • Instruction Fuzzy Hash: F6518CB2F08F5699F700EB66E8844BC37B0BB14BA4F5441B6DA4D53A64DF39E565C300
                                                                              Function 00007FFE11EB9FF0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Err_Unicode_$DecodeOccurredReadyString
                                                                              • String ID: multi-byte encodings are not supported$replace
                                                                              • API String ID: 1319564554-2045899619
                                                                              • Opcode ID: d4c1c5eafa3785139b68f326a19696d4b02b28e109f97959f1921c0f227bc78d
                                                                              • Instruction ID: 58fc7abf7e6cdab12937650c46a56b9e60ece7569fa3cd53bb4702299f774d4e
                                                                              • Opcode Fuzzy Hash: d4c1c5eafa3785139b68f326a19696d4b02b28e109f97959f1921c0f227bc78d
                                                                              • Instruction Fuzzy Hash: 27418371A0CE8382EF548FA69D4017A33A9BB45BF1F5451B6DA4E476B0DF2CE8558304
                                                                              Function 00007FFDFB1A23D3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
                                                                              • String ID: Service-0x$_OPENSSL_isservice
                                                                              • API String ID: 459917433-1672312481
                                                                              • Opcode ID: 79db5ee4ce9dc6ccf9bd915a9b468d2fbd35849815718b4b7a41fc8616343fad
                                                                              • Instruction ID: d607e57c3c44349edb2bf8beccbacc434d7b76aaafe80f244729d010c8832d7e
                                                                              • Opcode Fuzzy Hash: 79db5ee4ce9dc6ccf9bd915a9b468d2fbd35849815718b4b7a41fc8616343fad
                                                                              • Instruction Fuzzy Hash: BF415162B06B8396EB609F34D960AB82395EF447B8B544735E97D8A7F8DF2CE1548300
                                                                              Function 00007FFE11EBA590 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 91COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dict_Err_ItemOccurred$BuildCallDeallocDecodeErrorObject_Traceback_Unicode_ValueWith
                                                                              • String ID: (NN)$D:\a\1\s\Modules\pyexpat.c$StartNamespaceDecl
                                                                              • API String ID: 1461374241-2703805572
                                                                              • Opcode ID: c9965105b1e5023872393aa6f5c4cb6ce1f5c0438ad748433070bf6b076e749f
                                                                              • Instruction ID: 81dc28465cb9603fdbfa35be2ce0e460b012258f7af9a21e61f082be9d4c5d0f
                                                                              • Opcode Fuzzy Hash: c9965105b1e5023872393aa6f5c4cb6ce1f5c0438ad748433070bf6b076e749f
                                                                              • Instruction Fuzzy Hash: 2E316F65A08E4382EF159B939D4827A37A8BF84FE5F0890B2DE0D07778DE3CE4418304
                                                                              Function 00007FFE11EB1FA8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FromObject_$AttrCallDeallocErr_FormatLongLong_ObjectStringUnicode_
                                                                              • String ID: %s: line %i, column %i$code$lineno$offset
                                                                              • API String ID: 3270526086-733642575
                                                                              • Opcode ID: 130eec3d85cdee8b352909b319ba11d90a4deefe4052ac1d7ba20ce27dae6916
                                                                              • Instruction ID: 86984e237fa9c55f8da5aee87b47629c666a31e31cb12bfdd25aae4aaaf146c1
                                                                              • Opcode Fuzzy Hash: 130eec3d85cdee8b352909b319ba11d90a4deefe4052ac1d7ba20ce27dae6916
                                                                              • Instruction Fuzzy Hash: 90210621B08F0341EF189BA7AC4417B62A9BF49BF0F4864B6DE1E4B775DE2DE4448708
                                                                              Function 00007FFE11EC9C28 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 66COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              • read() returned too much data: %i bytes requested, %zd returned, xrefs: 00007FFE11EC9CDC
                                                                              • read() did not return a bytes object (type=%.400s), xrefs: 00007FFE11EC9C8F
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocErr_Format$CallFunctionObject_SubtypeType_memcpy
                                                                              • String ID: read() did not return a bytes object (type=%.400s)$read() returned too much data: %i bytes requested, %zd returned
                                                                              • API String ID: 3745068949-2560037398
                                                                              • Opcode ID: e59036ee43dd320841d96838c023520db304a8875f6a0a8073a88f4c421c5c7f
                                                                              • Instruction ID: 23096363321041bb14f1b596f6b3217737c36967ab6f67e9261e6f6f729c221d
                                                                              • Opcode Fuzzy Hash: e59036ee43dd320841d96838c023520db304a8875f6a0a8073a88f4c421c5c7f
                                                                              • Instruction Fuzzy Hash: 79310671A08E4381EF548BA7EC4077A27A8AB45FB4F98A0B1D91E477B4EE2CE5458340
                                                                              Function 00007FFE11EC9DD0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_$Mem_$FreeLongLong_MallocMemoryOccurredString
                                                                              • String ID: Cannot delete attribute$buffer_size must be an integer$buffer_size must be greater than zero
                                                                              • API String ID: 2113995896-4286141126
                                                                              • Opcode ID: 9d81060e4026ea8831fd93ca298b91c7abb9b9380591521893864cfe7697f52b
                                                                              • Instruction ID: a9e97b1263f8647e742b384be5a3140cd956d3c29175a129db9f424b70c077ae
                                                                              • Opcode Fuzzy Hash: 9d81060e4026ea8831fd93ca298b91c7abb9b9380591521893864cfe7697f52b
                                                                              • Instruction Fuzzy Hash: B4210C25A08E03C5EF548BA7EC8533A23A8BF54BB9F5561B1E90D462B4EF3CF4848701
                                                                              Function 00007FF7BD3B6680 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(WideCharToMultiByte,00007FF7BD3B1CE4,?,?,00000000,00007FF7BD3B6914), ref: 00007FF7BD3B66A7
                                                                              • FormatMessageW.KERNEL32 ref: 00007FF7BD3B66D6
                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF7BD3B672C
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                              • API String ID: 2383786077-2573406579
                                                                              • Opcode ID: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                                                              • Instruction ID: c0594de0d79d9287b83c5eb124a60ad215728328735715f8b49cf5a0ad33081e
                                                                              • Opcode Fuzzy Hash: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                                                              • Instruction Fuzzy Hash: E821652161CA42C1E768AB19E860266F365FBAA344FC40139E74D876AEFF3CD545CB20
                                                                              Function 00007FFDFB2ACBA0 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 238stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strncmp
                                                                              • String ID: %-8d$, path=$, retcode=$, value=$..\s\crypto\conf\conf_mod.c$OPENSSL_finish$OPENSSL_init$module=$path
                                                                              • API String ID: 1114863663-3652895664
                                                                              • Opcode ID: 3ecb68e670bea93246ef5374c4d0d7ba0649ab831daedc309e66f1fd15480d7f
                                                                              • Instruction ID: 25daa884303333772e6495a7938e2e820e5152fc08806be47a76a3d1e064b72c
                                                                              • Opcode Fuzzy Hash: 3ecb68e670bea93246ef5374c4d0d7ba0649ab831daedc309e66f1fd15480d7f
                                                                              • Instruction Fuzzy Hash: E5A1A262B0A64391FB209B55EA30AB92294AF44BC8F444135DE6D8BBFDEF3CF5458740
                                                                              Function 00007FFE1A458BA4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID:
                                                                              • API String ID: 2943138195-0
                                                                              • Opcode ID: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
                                                                              • Instruction ID: 56f909d69b1f1cf20fb15c748fcca14e974003353800fc56cc72e71922b216bb
                                                                              • Opcode Fuzzy Hash: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
                                                                              • Instruction Fuzzy Hash: 326170A2F14B5698FB01EBA2D8400FC37B1BB04BA8F5044B6DE0D6BA69DF78D555C740
                                                                              Function 00007FFDFB1A4B42 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 127stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strncmp
                                                                              • String ID: , value=$..\s\crypto\x509v3\v3_conf.c$/$ASN1:$DER:$critical,$name=
                                                                              • API String ID: 1114863663-1429737502
                                                                              • Opcode ID: 143978fd2adef66388680b9fe0611a0269c67ac45c0586c6bec754c205a70508
                                                                              • Instruction ID: 864a91ff66f8c3a6ce999b68db13b2cfcb82cafe83d5f31c6729823e556d04ec
                                                                              • Opcode Fuzzy Hash: 143978fd2adef66388680b9fe0611a0269c67ac45c0586c6bec754c205a70508
                                                                              • Instruction Fuzzy Hash: D141E922F0A68B46F710AB21A920B7AA6D1FF49BD8F444130DD6D077EDDE3DE9008700
                                                                              Function 00007FF7BD3BF5D8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: f$f$p$p$f
                                                                              • API String ID: 3215553584-1325933183
                                                                              • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                              • Instruction ID: 269c89211061b848dca959544a91fdc492e0bd3d647a81a66cab1e842b20abf4
                                                                              • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                              • Instruction Fuzzy Hash: D1128222A0E143C6FB68BA18D054679F351EBA2754FC45139F789476CEEB7FE4808B21
                                                                              Function 00007FFE1A4533E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                              • String ID: csm$csm$csm
                                                                              • API String ID: 211107550-393685449
                                                                              • Opcode ID: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
                                                                              • Instruction ID: 20cd599cd6a96cf8b22c4d9fa5763be91f5c11988486441bffc663a94f426c4f
                                                                              • Opcode Fuzzy Hash: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
                                                                              • Instruction Fuzzy Hash: 68E1A2B3A08A818AE714AF36D4903BD77A0FB45F68F1441B6DA8D47766CF38E595CB00
                                                                              Function 00007FFDFB1A41DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLastsetsockopt
                                                                              • String ID: ..\s\crypto\bio\b_sock2.c$o
                                                                              • API String ID: 1729277954-1872632005
                                                                              • Opcode ID: f8faf1672888dd055ca767ddbd6e928684f186272bd270f584dbc43e0a9459f0
                                                                              • Instruction ID: 835951790f9e6f0087fa514098c18f01f64d99b6cd7c4a3377c29f1431ddaefd
                                                                              • Opcode Fuzzy Hash: f8faf1672888dd055ca767ddbd6e928684f186272bd270f584dbc43e0a9459f0
                                                                              • Instruction Fuzzy Hash: 8D519C32B095838AE720DF21E824AAD77A1FB85748F444135EA6847BEDCF3DE509CB40
                                                                              Function 00007FFE1A45C1D8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                                                              • API String ID: 2943138195-2239912363
                                                                              • Opcode ID: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
                                                                              • Instruction ID: 6687bc44508bd485d866c25ff530da5c347406c5587ee02f6a3bf1957e2a0818
                                                                              • Opcode Fuzzy Hash: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
                                                                              • Instruction Fuzzy Hash: B1514CA2F18F4598FB11DB62D8412BD77B0BB08B64F4442F6DA4D13AA5DF3C90A4C754
                                                                              Function 00007FF7BD3B6140 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                              • API String ID: 2895956056-3524285272
                                                                              • Opcode ID: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                                                              • Instruction ID: 9d114a1be8cab9415e207323e7e19a21b95f1a9e75d2d632595eaa1dba65ec20
                                                                              • Opcode Fuzzy Hash: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                                                              • Instruction Fuzzy Hash: 8A410571A0C782C1DA24AB68F4552AAF364FBA5360F900739E7AD477DAEF7CD0548B10
                                                                              Function 00007FFDFB1A377E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strcmpstrncmpstrtoul
                                                                              • String ID: MASK:$default$nombstr$pkix$utf8only
                                                                              • API String ID: 1175158921-3483942737
                                                                              • Opcode ID: 0eb005829b5090700deec3fa77c1e89360f57b44948d3d3a333400b0d416245b
                                                                              • Instruction ID: 3abd8173b473a1e4cc2ca1856a0234dba99b0db78cd7b296f8ef861f405b5719
                                                                              • Opcode Fuzzy Hash: 0eb005829b5090700deec3fa77c1e89360f57b44948d3d3a333400b0d416245b
                                                                              • Instruction Fuzzy Hash: 41312C22B1D58386EB518B2CE570BB93790EB46754F444132EB6E87AFDDE2CE591C700
                                                                              Function 00007FFE11EC9860 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Err_$AttrLookupModuleObject_OccurredStateStringType_
                                                                              • String ID: argument must have 'read' attribute
                                                                              • API String ID: 2477349089-3754724333
                                                                              • Opcode ID: 47c45e2a14a7238e8279dac10566541dc6ab048936419c40543f633382c39a16
                                                                              • Instruction ID: 5ab0cb613d9555dccddad61e28757a23e78559a34f9bf410827d875a796bb361
                                                                              • Opcode Fuzzy Hash: 47c45e2a14a7238e8279dac10566541dc6ab048936419c40543f633382c39a16
                                                                              • Instruction Fuzzy Hash: FD313A22A09E4382EF549BA79C5037B67A8AF84FB0F9850B1DE4D47B74EE2DF4408740
                                                                              Function 00007FF7BD3BCFA0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                              • String ID: csm$csm$csm
                                                                              • API String ID: 849930591-393685449
                                                                              • Opcode ID: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                                                              • Instruction ID: 468d5dd6d38b11ca986ba912bd2d922aa65ad38380a56717e026a5e73c6b1c46
                                                                              • Opcode Fuzzy Hash: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                                                              • Instruction Fuzzy Hash: FDE1753690C745C6EB68AB69A4403ADF7A0FB56798F440139EF8E5775AEF38E041C710
                                                                              Function 00007FFDFB1A60D2 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Fiber$Switch$CreateDeletememmove
                                                                              • String ID: *$..\s\crypto\async\async.c
                                                                              • API String ID: 81049052-1471988776
                                                                              • Opcode ID: 4f9f709306536e867257e9e687ef2b36e2c087ecf2beff4b4f2d57b4d80d708d
                                                                              • Instruction ID: a7c3355cbb2bebe3e0f6a8c29dfe823e88d223b672da7264784b92eeeef6aa43
                                                                              • Opcode Fuzzy Hash: 4f9f709306536e867257e9e687ef2b36e2c087ecf2beff4b4f2d57b4d80d708d
                                                                              • Instruction Fuzzy Hash: 64A17E72B0A64389EB24DF19E4A0A7963A5EF58B84F044031DAAD877EDDF3CE555C700
                                                                              Function 00007FFE1A4561AA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
                                                                              • String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
                                                                              • API String ID: 1852475696-928371585
                                                                              • Opcode ID: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
                                                                              • Instruction ID: ec8f4461fab7ece41ab71fbbe15d9c9515926b36fe585e8b5474011d9effbad8
                                                                              • Opcode Fuzzy Hash: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
                                                                              • Instruction Fuzzy Hash: DC51A1A2B18E4692EE20EB56F4802B9A360FF44FA4F5441B3EA4E43675DF3CE525C700
                                                                              Function 00007FF7BD3B67D0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B686F
                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B68BF
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                              • API String ID: 626452242-27947307
                                                                              • Opcode ID: 842819fd0de434b72f89aea08788796a3a6fbb43ae32da6e9284d85ccd3845d2
                                                                              • Instruction ID: 92af4557c0dff79542e140b82ab8862b59e1798be57e24192fb7cf8b642f02dc
                                                                              • Opcode Fuzzy Hash: 842819fd0de434b72f89aea08788796a3a6fbb43ae32da6e9284d85ccd3845d2
                                                                              • Instruction Fuzzy Hash: 47419532A0DB82C1D624EF19B85016AF764FBA5790F984139EB8D47B9AEF3CD055C710
                                                                              Function 00007FFDFB1A1D48 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: HandleModule$AddressProc
                                                                              • String ID: OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
                                                                              • API String ID: 1883125708-4200109347
                                                                              • Opcode ID: f2636a76e782a0e1fa67e1c2fe2d0083f1ed94c4a280093996525d6ffba33d81
                                                                              • Instruction ID: 725c571440d3c441ee53e9119317844894b8997dc19fa3ab9dbcffeb4404594e
                                                                              • Opcode Fuzzy Hash: f2636a76e782a0e1fa67e1c2fe2d0083f1ed94c4a280093996525d6ffba33d81
                                                                              • Instruction Fuzzy Hash: 42512021F4AB4396F7119F24EA2097863E1BF58768B055736D97C022F9EF7CB1958300
                                                                              Function 00007FFE1A456B5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456BE1
                                                                              • GetLastError.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456BEF
                                                                              • wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C08
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C1A
                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C60
                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C6C
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
                                                                              • String ID: api-ms-
                                                                              • API String ID: 916704608-2084034818
                                                                              • Opcode ID: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
                                                                              • Instruction ID: c3f432e5d3511cab6fd39c14fd46c7bff2044fef2dfb103abe1d927c75857ece
                                                                              • Opcode Fuzzy Hash: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
                                                                              • Instruction Fuzzy Hash: CB31AE61B1AF4281EE22AB07A8005B5B2A4FB49FB5F5D05B6DD2D073A4EF3CE164C200
                                                                              Function 00007FFE11EC8BAC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Dict_Err_ItemOccurred$BuildCallDecodeErrorLongLong_Object_Unicode_ValueWith
                                                                              • String ID: (O&NNN)$ExternalEntityRef
                                                                              • API String ID: 1931057526-2495634347
                                                                              • Opcode ID: a3cda369f29552a83d93154c4b3623624351f277dccc2a5cc164bf2d60f1e1ed
                                                                              • Instruction ID: f39856f4ba6b6e673e29cbc9fa3965d1ff180c82e225b209cb0e5f89811e9b2a
                                                                              • Opcode Fuzzy Hash: a3cda369f29552a83d93154c4b3623624351f277dccc2a5cc164bf2d60f1e1ed
                                                                              • Instruction Fuzzy Hash: DF314C31A09E4286EB149FA7AD006AB63A8BB88FF4F480576EE4D07765DE3CE0418344
                                                                              Function 00007FFE11EBA690 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dict_Item$DeallocDecodeErr_ErrorOccurredUnicode_With
                                                                              • String ID: strict
                                                                              • API String ID: 3144736171-2947452218
                                                                              • Opcode ID: 5e8470bef52a21db2194219a123e6440e9148900759755f32bdfd493a8d5e30c
                                                                              • Instruction ID: 1f52f3be9108529b249a643f713932f8cf2d39a3566e4f519eea2f8e389a7525
                                                                              • Opcode Fuzzy Hash: 5e8470bef52a21db2194219a123e6440e9148900759755f32bdfd493a8d5e30c
                                                                              • Instruction Fuzzy Hash: CD210E65A0DF5381EF558BA7AD4427663A8BF89FB1F086271DA1F077B4DE2CE4418304
                                                                              Function 00007FFE11EB1354 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocList_$AppendBuildModule_ObjectValue
                                                                              • String ID: features
                                                                              • API String ID: 2094461166-3217087507
                                                                              • Opcode ID: 917ee4d600048b695800ecefbb4c9788cd921cf0f75658e09afc9bc6072e2315
                                                                              • Instruction ID: 12a1c552358c7aff762f1d1ca885b0083dbd68596e6187bd68f4ed262d207842
                                                                              • Opcode Fuzzy Hash: 917ee4d600048b695800ecefbb4c9788cd921cf0f75658e09afc9bc6072e2315
                                                                              • Instruction Fuzzy Hash: 6C213A32A08F0386EB108BA7BC0016B66A8BF45BB1F446576DD0E436A8EE3CE4568340
                                                                              Function 00007FF7BD3B6ED0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • WideCharToMultiByte.KERNEL32(00000000,00007FF7BD3B2D35,?,?,?,?,?,?), ref: 00007FF7BD3B6F11
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              • WideCharToMultiByte.KERNEL32(00000000,00007FF7BD3B2D35,?,?,?,?,?,?), ref: 00007FF7BD3B6F85
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                              • API String ID: 1717984340-27947307
                                                                              • Opcode ID: df947e153a4d297c551ea8f0f320faf028395d0bacfd384824c4aacdb755590f
                                                                              • Instruction ID: 33583444744e37d7b763640a9d7c862e1353f99fd043b47e74ca177c4c561d71
                                                                              • Opcode Fuzzy Hash: df947e153a4d297c551ea8f0f320faf028395d0bacfd384824c4aacdb755590f
                                                                              • Instruction Fuzzy Hash: 9E21932161DB42C5EB18AB1AAC50079FB61ABA5B80B984139E74D4776BFF3CE544C710
                                                                              Function 00007FFE11EC9998 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 40COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Arg_ArgumentErr_SizeStringUnicode_
                                                                              • String ID: SetBase$argument$embedded null character$str
                                                                              • API String ID: 4155279725-2697211746
                                                                              • Opcode ID: f0598db1ceddcb6529a4d36ce2328f930b62fbd93ac59356a2237b55f5fe339e
                                                                              • Instruction ID: 11c9425752150205e958758dd2113cd7ee6fab1a323da0a6a4b5e7487008090b
                                                                              • Opcode Fuzzy Hash: f0598db1ceddcb6529a4d36ce2328f930b62fbd93ac59356a2237b55f5fe339e
                                                                              • Instruction Fuzzy Hash: 7311FE61A18E4791EF448B9BEC502B66364EF44BB4F9562B1D92E077B4EE2CF5858300
                                                                              Function 00007FFDFB3A25B0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 190stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memsetstrncpy
                                                                              • String ID: , failure codes: $, status text: $..\s\crypto\ts\ts_rsp_verify.c$status code: $unknown code$unspecified
                                                                              • API String ID: 388311670-2553778726
                                                                              • Opcode ID: 4039b7292d998a5d8bce370844a9dd603b654c47650d4ae50a8630767a9223f1
                                                                              • Instruction ID: b4f199b90fd5b80299c31b1441cccb8469494e1394dc376c4aa45ec65f067008
                                                                              • Opcode Fuzzy Hash: 4039b7292d998a5d8bce370844a9dd603b654c47650d4ae50a8630767a9223f1
                                                                              • Instruction Fuzzy Hash: AC81C426F0E68386EB10FB11A960BB973D8EB85B84F500035D96D4B7EADF3CE1059700
                                                                              Function 00007FFE1A452818 Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort$AdjustPointer
                                                                              • String ID:
                                                                              • API String ID: 1501936508-0
                                                                              • Opcode ID: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
                                                                              • Instruction ID: b073622a3ceda261b0e01387bbdde0ab96bfadc6a741147bf3c4341d91097703
                                                                              • Opcode Fuzzy Hash: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
                                                                              • Instruction Fuzzy Hash: A751B1B1F09F4281EA69BB57944427963A0AF44FA4F0945F7EA4E077B5DE3CE461C300
                                                                              Function 00007FFE1A4529FC Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort$AdjustPointer
                                                                              • String ID:
                                                                              • API String ID: 1501936508-0
                                                                              • Opcode ID: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
                                                                              • Instruction ID: d69d25f26ad970d347bc150744c37bca5baeb512cba4ef2993ac404ef6882b0a
                                                                              • Opcode Fuzzy Hash: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
                                                                              • Instruction Fuzzy Hash: 7551B0A1B0AF4281FA65AF17944463863A4AF04FA1F0985F7EA4E077A5DF7CE861C310
                                                                              Function 00007FFE11EB1BC0 Relevance: 12.1, APIs: 8, Instructions: 84COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyModule_AddStringConstant.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C16
                                                                              • PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C26
                                                                              • PyDict_SetItemString.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C3D
                                                                              • PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C4E
                                                                              • PyDict_SetItem.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1C69
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0BD3
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0BE2
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1B11,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0BF1
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocString$Dict_FromItem$ConstantLongLong_Module_Unicode_
                                                                              • String ID:
                                                                              • API String ID: 3707016883-0
                                                                              • Opcode ID: 9894eb32ba501caf1d6953d2abb9eb4bde9c72cae1566bb8ef2456994ddd0a82
                                                                              • Instruction ID: cadd556ceb030309cf8b1b5c017d3b094e9e4a74c1f5ac8ee6c6935ebf16ce22
                                                                              • Opcode Fuzzy Hash: 9894eb32ba501caf1d6953d2abb9eb4bde9c72cae1566bb8ef2456994ddd0a82
                                                                              • Instruction Fuzzy Hash: D3315E21A08E0782EB198FA3AC4453B62ACBF45FF0F085575DD0E06764DE3CE4428344
                                                                              Function 00007FFE11EB1504 Relevance: 12.1, APIs: 8, Instructions: 61stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • strrchr.VCRUNTIME140(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1526
                                                                              • PyModule_New.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1532
                                                                              • PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB1543
                                                                              • _PyImport_SetModule.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB155B
                                                                              • PyModule_AddObject.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EB157D
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC08F2
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0905
                                                                              • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE11EB1AC1,?,?,?,00007FFE11EB114C), ref: 00007FFE11EC0914
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Module_$FromImport_ModuleObjectStringUnicode_strrchr
                                                                              • String ID:
                                                                              • API String ID: 261865307-0
                                                                              • Opcode ID: 210302b627e122efd3cef78b55169a79baa6ac8e2b2f46d66b12df1c2c4bfee5
                                                                              • Instruction ID: cf45215c7eb4ef84664e04a74686927dc22651db104dc25515ca7df325e9dd41
                                                                              • Opcode Fuzzy Hash: 210302b627e122efd3cef78b55169a79baa6ac8e2b2f46d66b12df1c2c4bfee5
                                                                              • Instruction Fuzzy Hash: 7721FC35E1DE4385EF544BA3AD1427B66A9AF46FF0F4C5071DA4E06774DE2CE5418340
                                                                              Function 00007FF7BD3C93D4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: f$p$p
                                                                              • API String ID: 3215553584-1995029353
                                                                              • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                              • Instruction ID: 4cc6ef968586023c12b3e987560ed59142393eb3db0a1b3862314240e5cf4513
                                                                              • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                              • Instruction Fuzzy Hash: 2D12A122A0C343C6FB28BE19D464279E251EB62752FDE4139D789476CEEE3DE5908730
                                                                              Function 00007FFE1A4557C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileHeader_local_unwind
                                                                              • String ID: MOC$RCC$csm$csm
                                                                              • API String ID: 2627209546-1441736206
                                                                              • Opcode ID: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
                                                                              • Instruction ID: af3261410b8b57851e1c5ea53baac3f38bf4cde2f13c01307c8b3dcb3715ac65
                                                                              • Opcode Fuzzy Hash: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
                                                                              • Instruction Fuzzy Hash: ED5163B2B09E1286EB60AB26904137D66A0FF44FB4F1410F3DA4D977A5DF3CE465C642
                                                                              Function 00007FFE1A45E520 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: {for
                                                                              • API String ID: 2943138195-864106941
                                                                              • Opcode ID: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
                                                                              • Instruction ID: 97ed77b46a60022236015673ed4870fce22d5ef1c1a3cbaa0c846a6da1d03f47
                                                                              • Opcode Fuzzy Hash: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
                                                                              • Instruction Fuzzy Hash: 2A514AB2B08A85A9E711EF26D4413F867A1EB44B98F8084F2EA5C47BA5DF7CD564C340
                                                                              Function 00007FFDFB1A54CA Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 121stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strchr$memmove
                                                                              • String ID: characters$ to $..\s\crypto\ui\ui_lib.c$You must type in
                                                                              • API String ID: 1080442166-3422546668
                                                                              • Opcode ID: e1d467c1ab8b172e9e243a46dfee5ce5121d718340360ba0c754f62a78f21d98
                                                                              • Instruction ID: 36359a27c9a2fd2e788fafab139d770c6b26a39b4e72474298592f41ce88d26b
                                                                              • Opcode Fuzzy Hash: e1d467c1ab8b172e9e243a46dfee5ce5121d718340360ba0c754f62a78f21d98
                                                                              • Instruction Fuzzy Hash: A551B576B4A6938BEB21AF24D96097877A4EB45B48F104135DA6C0B7EDCF3CE944C740
                                                                              Function 00007FFE11EC95C0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: MallocMem_Object_$DeallocErr_MemoryModuleStateTrackType_
                                                                              • String ID:
                                                                              • API String ID: 702796062-0
                                                                              • Opcode ID: 7cb1b6b14d9fbbf55148c9a9e73415ff782f4526333f6db7c09006cb15fc7f27
                                                                              • Instruction ID: dd9338db5409b806a3f14486c0f7050eb63b4d4714cb72a316d3e9f5b568391d
                                                                              • Opcode Fuzzy Hash: 7cb1b6b14d9fbbf55148c9a9e73415ff782f4526333f6db7c09006cb15fc7f27
                                                                              • Instruction Fuzzy Hash: 3B413A72A15F4286EB648FA6EC5437A33A8FB48BA4F445275DA5E477A4EF3CE440C300
                                                                              Function 00007FF7BD3B6FC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                              • API String ID: 626452242-876015163
                                                                              • Opcode ID: c63a8705ae77710e22cb38bb79ea38e96bc84988aed726f017d1a1a1dd5352b3
                                                                              • Instruction ID: d2f47c1a21062996c9d1d6f679df1a63038ff6c4db0f2bbd3238e7bc3481b3cc
                                                                              • Opcode Fuzzy Hash: c63a8705ae77710e22cb38bb79ea38e96bc84988aed726f017d1a1a1dd5352b3
                                                                              • Instruction Fuzzy Hash: 7541C372A0CB42C5E614EF19A840265F6A5FB65780F984139EB8D47BAAEF3CD051C710
                                                                              Function 00007FFE11EC8A38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Dict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: EntityDecl$NiNNNNN
                                                                              • API String ID: 2384994390-924104366
                                                                              • Opcode ID: 133638af195f1dd530839e5bfe393b065e0c6411a05adc9108dccaa6754db0fe
                                                                              • Instruction ID: bc41982ed81927b01528f6f313ea2b71aa08c47631d5c9886b89766a0f5a552e
                                                                              • Opcode Fuzzy Hash: 133638af195f1dd530839e5bfe393b065e0c6411a05adc9108dccaa6754db0fe
                                                                              • Instruction Fuzzy Hash: FC315C66A08B8281EB109B93AD047AB73A8BB89FF4F484476EE4D07765DF3CE0418744
                                                                              Function 00007FFDFB1A2E4B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: EnvironmentVariable
                                                                              • String ID: OPENSSL_ia32cap$~$~$~$~
                                                                              • API String ID: 1431749950-1981414212
                                                                              • Opcode ID: cf480c52fdec152708fcec39c4b82c05f8550ca0c57a004c4734a86e6d7d47de
                                                                              • Instruction ID: 06393246a6c51dfca754fb5bf20b76412e675109945b19e71fb16182ca72a5ab
                                                                              • Opcode Fuzzy Hash: cf480c52fdec152708fcec39c4b82c05f8550ca0c57a004c4734a86e6d7d47de
                                                                              • Instruction Fuzzy Hash: B6419D65F0E65795E7149B01AA619B833A4EB04BD4F844135D97E8BAFCEF3CE481C740
                                                                              Function 00007FFE1A45DB00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: NameName::atol
                                                                              • String ID: `template-parameter$void
                                                                              • API String ID: 2130343216-4057429177
                                                                              • Opcode ID: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
                                                                              • Instruction ID: d799e140f4e2e25e6ee784e37a1a86591171988aadf1b5130a3f4c64bf3e4f20
                                                                              • Opcode Fuzzy Hash: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
                                                                              • Instruction Fuzzy Hash: EA417B62F08F4688FB00DB66D8512FC2371BF48BA8F5401B6DE5C67A68DF789465C340
                                                                              Function 00007FF7BD3B55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FF7BD3B6DC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6DFA
                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7BD3B5931,?,?,00000000,?,?,00007FF7BD3B58AD), ref: 00007FF7BD3B563F
                                                                              Strings
                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7BD3B5616
                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7BD3B569A
                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7BD3B5653
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                              • API String ID: 2001182103-3498232454
                                                                              • Opcode ID: 22df63ef2f3e76b3626f1eb672273def7074d3b8183cbbd32400c4ff734ed995
                                                                              • Instruction ID: 43494b8ce88491b37edf37ec4e7fb5141a3698f6d491cecec88d530dcd0ac7d8
                                                                              • Opcode Fuzzy Hash: 22df63ef2f3e76b3626f1eb672273def7074d3b8183cbbd32400c4ff734ed995
                                                                              • Instruction Fuzzy Hash: 6E316851B1D742C0FA69B72999153B9F251AFBA780FC44439EB4E4369FFE2CE1048720
                                                                              Function 00007FF7BD3BC258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC2DD
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC2EB
                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC315
                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC35B
                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7BD3BC50A,?,?,?,00007FF7BD3BC1FC,?,?,00000001,00007FF7BD3BBE19), ref: 00007FF7BD3BC367
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                              • String ID: api-ms-
                                                                              • API String ID: 2559590344-2084034818
                                                                              • Opcode ID: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                                                              • Instruction ID: 3e159bd9ae40d57ab114fb486dd6fbf3d946eac754b7529e0357083ffdcbeebc
                                                                              • Opcode Fuzzy Hash: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                                                              • Instruction Fuzzy Hash: D531E725A0E602C1EE69BB2A9410575F294BF6AB90FCD0538EF1D4735AFF3CE0448724
                                                                              Function 00007FFE11EC918C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Dict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (NNNNN)$UnparsedEntityDecl
                                                                              • API String ID: 2384994390-4202326955
                                                                              • Opcode ID: 002de062773e735def128884d516483ff06dc4c12868f817e564735d270edbbd
                                                                              • Instruction ID: dd84867ab9a463ecd84ab7e5251c4822c8dac556e908d4aa8ca04a2cec4e9abd
                                                                              • Opcode Fuzzy Hash: 002de062773e735def128884d516483ff06dc4c12868f817e564735d270edbbd
                                                                              • Instruction Fuzzy Hash: 69313C71A08E4282EF159B93AC0426BB7A9BF89FE0F4845B5DE8D17779DE3CE0419344
                                                                              Function 00007FFE1A458900 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+Replicator::operator[]
                                                                              • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                                                              • API String ID: 1405650943-2211150622
                                                                              • Opcode ID: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
                                                                              • Instruction ID: 4b7c24c9c4c32a3e6b0cc09325b764d7474eed1009fb21bd1135b9d4b64c048f
                                                                              • Opcode Fuzzy Hash: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
                                                                              • Instruction Fuzzy Hash: 114146A2F08F8699F7129B26D8402B877B0BB08B58F4445F6CA5C533A4DF7CA5A1D341
                                                                              Function 00007FFE1A45A6E4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: char $int $long $short $unsigned
                                                                              • API String ID: 2943138195-3894466517
                                                                              • Opcode ID: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
                                                                              • Instruction ID: 2e23e24836c591e60cb760a3ae457d19dbb094d1e5b238fa4d6f5533e3d4cc64
                                                                              • Opcode Fuzzy Hash: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
                                                                              • Instruction Fuzzy Hash: 88313AB2F18B4589F7019B2AC8583B827B1BB05B68F5481F2CA1C16AB8DF3CD564C750
                                                                              Function 00007FFE11EC8DB4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Dict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (NNNN)$NotationDecl
                                                                              • API String ID: 2384994390-1686118283
                                                                              • Opcode ID: 32622afc7d9457b4187bcf57a7d64f2c6b28dfe7c7cbb8abc10128d104fd37f5
                                                                              • Instruction ID: 9d6ef79bece1eb3f5640c5a7c266af4176e41b08499dd8bb8f5d7c67f9579fe8
                                                                              • Opcode Fuzzy Hash: 32622afc7d9457b4187bcf57a7d64f2c6b28dfe7c7cbb8abc10128d104fd37f5
                                                                              • Instruction Fuzzy Hash: 53312F71A08A8289EF149F93AD0467B73A8BB85FF4F480176EE4D07765DE3CE4418748
                                                                              Function 00007FFE11EC8798 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildDict_Err_ItemOccurredValue$DecodeErrorTuple_Unicode_With
                                                                              • String ID: ElementDecl
                                                                              • API String ID: 3369064983-3989113327
                                                                              • Opcode ID: 5f6f0c3fdefc0d30e23ae9e97e15a80f9e75311a9d222ede4bb6d68e2c3893ff
                                                                              • Instruction ID: 274ed815bc9f138abbb6b65d0639d1ac3bf604f1a3009ec63002b86753f05191
                                                                              • Opcode Fuzzy Hash: 5f6f0c3fdefc0d30e23ae9e97e15a80f9e75311a9d222ede4bb6d68e2c3893ff
                                                                              • Instruction Fuzzy Hash: 1C310A26A09F4281EF149B93AE0437BA3A8AF45BB4F985175DE0D07BA5EF3CF4418340
                                                                              Function 00007FFDFB1A39BD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _chmod_stat64i32fclosefwrite
                                                                              • String ID: ..\s\crypto\rand\randfile.c$Filename=
                                                                              • API String ID: 4260490851-2201148535
                                                                              • Opcode ID: 8e0a9474f630242c8024cca5bc5f23566c113e024c103529736493676b206fa0
                                                                              • Instruction ID: fa3eca2ddd6498b3ac5b7b4d8378cc2d8a7363ab0c467cd3c2e34f91470131ba
                                                                              • Opcode Fuzzy Hash: 8e0a9474f630242c8024cca5bc5f23566c113e024c103529736493676b206fa0
                                                                              • Instruction Fuzzy Hash: C9318F72B0E64786EB10EB15E960BA963A5EF85748F404135DA2D47AEDEF3CF518C700
                                                                              Function 00007FFE11EBC320 Relevance: 10.6, APIs: 7, Instructions: 74COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocFreeMem_Object_$Track
                                                                              • String ID:
                                                                              • API String ID: 2141335114-0
                                                                              • Opcode ID: 20dd7b8d0dbc48d714609b2b9538a0f5e7241d86dea07c5d1e8cb36cfad0da5a
                                                                              • Instruction ID: 84aeb769f20eb2e2983a56b5f153c3fe3fb023d0bc8338825da7ef70067612b3
                                                                              • Opcode Fuzzy Hash: 20dd7b8d0dbc48d714609b2b9538a0f5e7241d86dea07c5d1e8cb36cfad0da5a
                                                                              • Instruction Fuzzy Hash: 08310D36909F42C6DB149FA2AC4017E73A8FB49BB4B5815B5EA4E47A24CF3CD560C344
                                                                              Function 00007FFE11EC9074 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Dict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (NNNi)$StartDoctypeDecl
                                                                              • API String ID: 2384994390-3468646127
                                                                              • Opcode ID: 09eeef058cbb449473f66dbba458fd5a0346be9f47bd87c939b78e6464927644
                                                                              • Instruction ID: 7f6689ed99851952c8433c37e295ea84170ca32f5d579fb54eb932e5fd02ff66
                                                                              • Opcode Fuzzy Hash: 09eeef058cbb449473f66dbba458fd5a0346be9f47bd87c939b78e6464927644
                                                                              • Instruction Fuzzy Hash: 02212F31A08B5286EB149B939C0526BA7E8BB89FE4F4901B9DE4D07775EF3CE4418344
                                                                              Function 00007FFE11EC85AC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocDict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (NNO&O&i)$AttlistDecl
                                                                              • API String ID: 3887327737-3385402447
                                                                              • Opcode ID: 957addba2489eccb0ee01b3d5cd7dcea7b6e51bcc7c4e6b3cdecece487c79ae1
                                                                              • Instruction ID: 5f494c24f1d66122e0a0e87f7351ec4730dbb6f96c02d92355c7e32112388d12
                                                                              • Opcode Fuzzy Hash: 957addba2489eccb0ee01b3d5cd7dcea7b6e51bcc7c4e6b3cdecece487c79ae1
                                                                              • Instruction Fuzzy Hash: CF314F31A08F4282EB149B93AE4477A73A8FB98BE4F484175EA4D07B65DF3CE0558744
                                                                              Function 00007FF7BD3B6DC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6DFA
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7BD3B6E80
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                              • API String ID: 1717984340-876015163
                                                                              • Opcode ID: 13a0b7f3fd21cee1c2cd62ee385234548c1439332c91f829e0dfe80559821203
                                                                              • Instruction ID: 43019b4954d51c81cb7c509cd164a11531004945b6041284c7f790dd7be236ee
                                                                              • Opcode Fuzzy Hash: 13a0b7f3fd21cee1c2cd62ee385234548c1439332c91f829e0dfe80559821203
                                                                              • Instruction Fuzzy Hash: A021D725B1CA42C1EB54EB2DF810166E361EBAA7C4F8C4139EB4C8376EFE2CD5818700
                                                                              Function 00007FFE13302250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyModule_GetState.PYTHON311(?,?,00000000,00007FFE13302110), ref: 00007FFE1330226A
                                                                              • _Py_hashtable_get.PYTHON311(?,?,00000000,00007FFE13302110), ref: 00007FFE1330227A
                                                                              • EVP_get_digestbyname.LIBCRYPTO-1_1(?,?,00000000,00007FFE13302110), ref: 00007FFE133022BA
                                                                              • EVP_get_digestbyname.LIBCRYPTO-1_1(?,?,00000000,00007FFE13302110), ref: 00007FFE133022D2
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: P_get_digestbyname$Module_Py_hashtable_getState
                                                                              • String ID: unsupported hash type %s
                                                                              • API String ID: 3106711627-1604032313
                                                                              • Opcode ID: 67812a4578febaac995a36f8f4713c82c213913e0e18a1f50772f87860905fed
                                                                              • Instruction ID: fba9289d2250e93518e8861502ce37280abe907186cf37db0e60d7f1ed0f345e
                                                                              • Opcode Fuzzy Hash: 67812a4578febaac995a36f8f4713c82c213913e0e18a1f50772f87860905fed
                                                                              • Instruction Fuzzy Hash: 36212132A08E4689EAA58B57D44423D63A9EFA9BB0F1501B5D96D637B4CF3CE580C308
                                                                              Function 00007FF7BD3CA790 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA79F
                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA7B4
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA7D5
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA802
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA813
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA824
                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F,?,?,?,00007FF7BD3C9483), ref: 00007FF7BD3CA83F
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value$ErrorLast
                                                                              • String ID:
                                                                              • API String ID: 2506987500-0
                                                                              • Opcode ID: 0e939324b748cc2434b205d84fc0d0a7dc89f7974af049da77980cbf7db2f024
                                                                              • Instruction ID: 29f4fc0e4a7f8aee5534c9c7f14c1e7fc5a4232ad2de6063861c5116dfcd1ed4
                                                                              • Opcode Fuzzy Hash: 0e939324b748cc2434b205d84fc0d0a7dc89f7974af049da77980cbf7db2f024
                                                                              • Instruction Fuzzy Hash: 47215E20F0D302C2F56C73696551239E6525FA77A0F98463CDA3E076CFFE2CA4418324
                                                                              Function 00007FFE11EC92D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: (O&O&i)$XmlDecl
                                                                              • API String ID: 1677464630-1850199684
                                                                              • Opcode ID: c8029abda4df616d2335b34727fd60721a7f93f955b8ed55be75da175484939c
                                                                              • Instruction ID: dcdcfc67567e6ac963b9a31a34cc822018e19f43e4f7fb3410eab3ddf8f8f004
                                                                              • Opcode Fuzzy Hash: c8029abda4df616d2335b34727fd60721a7f93f955b8ed55be75da175484939c
                                                                              • Instruction Fuzzy Hash: 53215E31A08F5282EB148BA6ED4036A63B8FF44BA4F485175DA4D0BBB5EF3DE4518740
                                                                              Function 00007FFE11EC8CD8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_LongLong_Object_OccurredValue
                                                                              • String ID: NotStandalone
                                                                              • API String ID: 1294825290-2808886647
                                                                              • Opcode ID: 9f5384b9e1f92a79eb95630dfebb662f1c8ea3b42a38f01036de380a72164f26
                                                                              • Instruction ID: 56a2d41674288c6fb6192157a8c1869f89a310149a4a1b1b6716554a87ca75fe
                                                                              • Opcode Fuzzy Hash: 9f5384b9e1f92a79eb95630dfebb662f1c8ea3b42a38f01036de380a72164f26
                                                                              • Instruction Fuzzy Hash: 3D215031A08E4286EB509BA3AD4027BA7A8FF54BB4F980175DA4D07B74DF3DE451C300
                                                                              Function 00007FFE11EBBA74 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocDict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (NO&)$ProcessingInstruction
                                                                              • API String ID: 3887327737-1976967776
                                                                              • Opcode ID: 531e1765fc80bffab221f944b5c4f86a7fe5b05bbe1c959d904660c2f32b6865
                                                                              • Instruction ID: 822f59674d1416224f7d50d34b51d03ccefe0afe3486cd225d05294a5085b824
                                                                              • Opcode Fuzzy Hash: 531e1765fc80bffab221f944b5c4f86a7fe5b05bbe1c959d904660c2f32b6865
                                                                              • Instruction Fuzzy Hash: 39213021A08E5242EF249B93ED842BA63A8BF45BE4F0845B6DE4D077B5DF2CE4458344
                                                                              Function 00007FFE11EBC06C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dict_Err_ItemOccurred$BuildCallDeallocDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: (N)$EndNamespaceDecl
                                                                              • API String ID: 3568289713-1490285299
                                                                              • Opcode ID: 126c8f59c007d7fc377e8d958a162895bb3311542544022065567f7085a7e536
                                                                              • Instruction ID: d9a9c5c1cfb46b538417c6777a6faaf5e5931a06f168e70ac40ce9fe08a43fb2
                                                                              • Opcode Fuzzy Hash: 126c8f59c007d7fc377e8d958a162895bb3311542544022065567f7085a7e536
                                                                              • Instruction Fuzzy Hash: 18213B25A0CE4382EB148B93AD0427B63B8BF45BE4F1851B6DA4D177B5EF3CE8558344
                                                                              Function 00007FFE11EC86C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: (N)$Default
                                                                              • API String ID: 1677464630-894064132
                                                                              • Opcode ID: 28ecd4c5d4025a43b47768154c354b68746e2180b86aa5994ce0e4dc2e6449bf
                                                                              • Instruction ID: 8cfaa7802b5d439c5918a8a541f0a2ff3289b1226ded5d796c80e2372f06173f
                                                                              • Opcode Fuzzy Hash: 28ecd4c5d4025a43b47768154c354b68746e2180b86aa5994ce0e4dc2e6449bf
                                                                              • Instruction Fuzzy Hash: EA218121A08F5282EB144B93DE0437E63A8BF45BB4F884175DA4C57BB5EF3CE4528340
                                                                              Function 00007FFE11EBB8C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: (O&)$Comment
                                                                              • API String ID: 1677464630-4157610253
                                                                              • Opcode ID: e52393e59cd8ab4a03cec79f56ae0c19b82339798d1374d714194a96a62e189f
                                                                              • Instruction ID: b24f7edb52faef6c831632dd59fd2c49ba33475afd63d75504334c74d8489c75
                                                                              • Opcode Fuzzy Hash: e52393e59cd8ab4a03cec79f56ae0c19b82339798d1374d714194a96a62e189f
                                                                              • Instruction Fuzzy Hash: 1E111A21A08E5682FF249BA3ED0437A63A8BF45BE4F0841B6DA4D077B1EF2DE4558344
                                                                              Function 00007FF7BD3D70FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                              • String ID: CONOUT$
                                                                              • API String ID: 3230265001-3130406586
                                                                              • Opcode ID: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                                                              • Instruction ID: b842a94c9f96ababdf988789b92d1f6feeaba91113d7d4c8505609732cad9c64
                                                                              • Opcode Fuzzy Hash: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                                                              • Instruction Fuzzy Hash: AE11B721A1CA42C6E7549B0AF854325E2A0FB69BE4F444238DB1D437A9EF7CD4048714
                                                                              Function 00007FFE11EBDF10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_Mem_$FreeMallocMemoryObject_StringTrue
                                                                              • String ID: Cannot delete attribute
                                                                              • API String ID: 3601117635-1790985853
                                                                              • Opcode ID: d8124877790e7622a097d5a22737a4627b7f6c18e69dfbd447250a29ffa55de6
                                                                              • Instruction ID: 0c9aea4386f87a1d9f9689d9a1976e22894f4d6d6337679aede44fcc3ed9c497
                                                                              • Opcode Fuzzy Hash: d8124877790e7622a097d5a22737a4627b7f6c18e69dfbd447250a29ffa55de6
                                                                              • Instruction Fuzzy Hash: F711F765A0DE0381EF249BE39C5433A22A8BF48B79F1461B2D91E862B1DF2DF484C305
                                                                              Function 00007FFDFB1A648D Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 109stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strncmp
                                                                              • String ID: ASN1:$DER:$critical,
                                                                              • API String ID: 1114863663-369496153
                                                                              • Opcode ID: 73dbe8a7fb2b7298154a64a71f77702ab256a3369e9a1f498dc58ab828e17128
                                                                              • Instruction ID: 7bf67fb358306f1fba2a6adb738f0eda382df29d888f9de18ad5289979fa3e29
                                                                              • Opcode Fuzzy Hash: 73dbe8a7fb2b7298154a64a71f77702ab256a3369e9a1f498dc58ab828e17128
                                                                              • Instruction Fuzzy Hash: 0941E812B4A69B06F7106B26A920B3AA6D5AF09FD8F084034DD7D477FDDE3DE8048740
                                                                              Function 00007FFDFB1A4DF9 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 108stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strncmp
                                                                              • String ID: ASN1:$DER:$critical,
                                                                              • API String ID: 1114863663-369496153
                                                                              • Opcode ID: f62d61b209e271971fe335ffc6509810b63e2710eb999574c42c4a8ef04bc1b2
                                                                              • Instruction ID: 30fef4a9201e5a5dd0e24c955cfbbf523360e02f4a904b2d470593808064691f
                                                                              • Opcode Fuzzy Hash: f62d61b209e271971fe335ffc6509810b63e2710eb999574c42c4a8ef04bc1b2
                                                                              • Instruction Fuzzy Hash: 1C41E522B1A68742FB106B26A960B79A6D1FB49BD8F445030DD7D47BEDDE3DE8048700
                                                                              Function 00007FFE1A456570 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
                                                                              • String ID:
                                                                              • API String ID: 3741236498-0
                                                                              • Opcode ID: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
                                                                              • Instruction ID: 46bfee7169a7b774ce68bc71c4467136af0c612f772fbebac381b7c865fffa3f
                                                                              • Opcode Fuzzy Hash: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
                                                                              • Instruction Fuzzy Hash: 1031B261B19B9591EB119B27B804579A3A4FF08FF4B5946B6DD2D433A0EE3DD462C300
                                                                              Function 00007FFE13303760 Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Mem_Py_hashtable_set$FreeMallocPy_hashtable_destroyPy_hashtable_new_full
                                                                              • String ID:
                                                                              • API String ID: 3987031744-0
                                                                              • Opcode ID: 4d3727f9dcbb20985ec9bf9f97716139e44a5e8b477380798206113630c02f70
                                                                              • Instruction ID: bf0af012d8784f87c6baf6b89c69bfb55be7966c81196b98056d529be1cd18e8
                                                                              • Opcode Fuzzy Hash: 4d3727f9dcbb20985ec9bf9f97716139e44a5e8b477380798206113630c02f70
                                                                              • Instruction Fuzzy Hash: 8D215E21A1CF4686F7118B26D44037D63A4FF64BA5F0451B1DA5D227B0DF3CE199C308
                                                                              Function 00007FF7BD3CA908 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA917
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA94D
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA97A
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA98B
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA99C
                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7BD3C60A1,?,?,?,?,00007FF7BD3CDF2F,?,?,00000000,00007FF7BD3CAA26,?,?,?), ref: 00007FF7BD3CA9B7
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value$ErrorLast
                                                                              • String ID:
                                                                              • API String ID: 2506987500-0
                                                                              • Opcode ID: fd355e16ec1b8389c326bb7a0c1288e1e744e38f9cf313ad355fe3b15a8e35c3
                                                                              • Instruction ID: ba54a310d88874236fbdb84d322050d41d40ac447218f561f1c323d22ed5de28
                                                                              • Opcode Fuzzy Hash: fd355e16ec1b8389c326bb7a0c1288e1e744e38f9cf313ad355fe3b15a8e35c3
                                                                              • Instruction Fuzzy Hash: 4D115E21A0C346C2F65C7329A552279E2424FAB7B0F89473CDA3E476DFFD2CA4418724
                                                                              Function 00007FFE13306168 Relevance: 9.0, APIs: 6, Instructions: 34threadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lockX_copy
                                                                              • String ID:
                                                                              • API String ID: 1756194536-0
                                                                              • Opcode ID: 8fff098642709bb73204b4a8ac8639e22a3ced04d8aabff8f524475106d8fc93
                                                                              • Instruction ID: fc166a830a4a00cab6d35dbb1f7eabbf6b4aed59167b1ceed831cc3a7e002548
                                                                              • Opcode Fuzzy Hash: 8fff098642709bb73204b4a8ac8639e22a3ced04d8aabff8f524475106d8fc93
                                                                              • Instruction Fuzzy Hash: 9201E825B09F4286FB498B63E95412D2360FFA8FA0B1450B4DE6E53B29CF3CE4A58744
                                                                              Function 00007FFE1A453AEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort$CallEncodePointerTranslator
                                                                              • String ID: MOC$RCC
                                                                              • API String ID: 2889003569-2084237596
                                                                              • Opcode ID: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
                                                                              • Instruction ID: 5c64eea22f5e13ad19ae8b0426fc0bbcd175eecf271101e4558b188fb0d97d02
                                                                              • Opcode Fuzzy Hash: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
                                                                              • Instruction Fuzzy Hash: CA91B2B3B08B818AE711DB66E4502BD77B0F745B98F1041AAEB4D17765DF38E1A5CB00
                                                                              Function 00007FFE1A45BF20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
                                                                              • API String ID: 2943138195-757766384
                                                                              • Opcode ID: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
                                                                              • Instruction ID: 29c53ade6ae3f4328f2829b6d4b15d187fcb185a19ff92ec2a2bb5f26bb3bcdb
                                                                              • Opcode Fuzzy Hash: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
                                                                              • Instruction Fuzzy Hash: 14716AB2F08E4294EB14AF6699400BC67A1BB05FA4F4446F6DA5D83A74DF3CE5B0CB40
                                                                              Function 00007FFE1A4538D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort$CallEncodePointerTranslator
                                                                              • String ID: MOC$RCC
                                                                              • API String ID: 2889003569-2084237596
                                                                              • Opcode ID: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
                                                                              • Instruction ID: 4eb49792d1089a7686f51271e6a78c53ac0f7dc4092eaef492428ecd1f46ecac
                                                                              • Opcode Fuzzy Hash: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
                                                                              • Instruction Fuzzy Hash: 3C612BB2A08B458AEB109F66D4403BD77A0FB44B98F0442A6EE4D17BA9CF78E565C700
                                                                              Function 00007FF7BD3BBC18 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                              • String ID: csm$f
                                                                              • API String ID: 2395640692-629598281
                                                                              • Opcode ID: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                                                              • Instruction ID: c5102b279eed2fc118f84790d36a2eadaecb3b6f248f11b9dfcba135aaf7349f
                                                                              • Opcode Fuzzy Hash: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                                                              • Instruction Fuzzy Hash: C4519031A0E602CADB18AF19D504A29F755FB65B88F908538EB4A0774EEE3CE941C720
                                                                              Function 00007FFDFB266E10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: getnameinfohtonsmemset
                                                                              • String ID: $..\s\crypto\bio\b_addr.c
                                                                              • API String ID: 165288700-1606403076
                                                                              • Opcode ID: e223affc2ac3203e319be5c56c676065cae7187c143fb2084f86007e6ab65d6f
                                                                              • Instruction ID: 652387f771552d0eca20721bc49780ec700f7f68058b8a25205c76becbfb163d
                                                                              • Opcode Fuzzy Hash: e223affc2ac3203e319be5c56c676065cae7187c143fb2084f86007e6ab65d6f
                                                                              • Instruction Fuzzy Hash: 0F51C562B0A6838AFB219B11E520AB977A1FB40748F404035EBAD875FDDF3DF5958B40
                                                                              Function 00007FFE11EC8ED8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocDict_Err_ItemOccurred$BuildCallDecodeErrorObject_Unicode_ValueWith
                                                                              • String ID: SkippedEntity
                                                                              • API String ID: 3887327737-2419268895
                                                                              • Opcode ID: d79c4e74fda7ba8cb6aedecf0c6f9dd1662a63f4c51f772058032f8eb0f39330
                                                                              • Instruction ID: 576ea9f09cb1a8157b3d105b645c86a7a99e9104c06a184d938e43e0c7852d27
                                                                              • Opcode Fuzzy Hash: d79c4e74fda7ba8cb6aedecf0c6f9dd1662a63f4c51f772058032f8eb0f39330
                                                                              • Instruction Fuzzy Hash: AE215E21A08E9742EB145B939E047BA63A9BF45BF4F4840B5DA4D17BA5EF3CE4958300
                                                                              Function 00007FFE11EC8974 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: EndDoctypeDecl
                                                                              • API String ID: 1677464630-3017262571
                                                                              • Opcode ID: 56267da99f7f46cb6b54bced766cc3e329760953c7680eb73a88b59284aa4109
                                                                              • Instruction ID: 981dfa13408001bb2d1633c13c65e259e30b939a010ed5c6cb7d21bf26bd6cf1
                                                                              • Opcode Fuzzy Hash: 56267da99f7f46cb6b54bced766cc3e329760953c7680eb73a88b59284aa4109
                                                                              • Instruction Fuzzy Hash: 9D116A31A18E4282EB548F96AE0477A63A8BF45BB4F5841B5DA4D037A4DF3DE4458300
                                                                              Function 00007FFE11EC88B8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: EndCdataSection
                                                                              • API String ID: 1677464630-4040879477
                                                                              • Opcode ID: 7763d68e44867354b0986dafccaaa0a8a9b2a83968429e2a9df45a2e95ad3a30
                                                                              • Instruction ID: fd5864084930880007d8e0fe753797ac4967f93ba0a9819f15b89249976b3391
                                                                              • Opcode Fuzzy Hash: 7763d68e44867354b0986dafccaaa0a8a9b2a83968429e2a9df45a2e95ad3a30
                                                                              • Instruction Fuzzy Hash: 4F113731A08E4382EB509BA2AE047BA63B8BF45FB4F4801B5DA8D177A5DF3DE4458341
                                                                              Function 00007FFE11EC8FB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$BuildCallErr_Object_OccurredValue
                                                                              • String ID: StartCdataSection
                                                                              • API String ID: 1677464630-113579994
                                                                              • Opcode ID: 62eca9a9599ab21fed1b3beb81f00a1a0d815c8fb695054c03675e8efc047639
                                                                              • Instruction ID: c51283a8717cf92b0e8c2bf191f22bdae348c181e3f15356834328175105f479
                                                                              • Opcode Fuzzy Hash: 62eca9a9599ab21fed1b3beb81f00a1a0d815c8fb695054c03675e8efc047639
                                                                              • Instruction Fuzzy Hash: D4114F31A08E4282EB508B92AD0537A63A8FF44FA4F980175DE4D077B5EF3DE5858340
                                                                              Function 00007FFE11ECC580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35timeCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Time$CurrentFileProcessSystemrand_s
                                                                              • String ID: fallback(4)$rand_s
                                                                              • API String ID: 2124637630-25474216
                                                                              • Opcode ID: e4ca9bb7183159477e85330442c830f61963799a3a423287df70db553be7dc1c
                                                                              • Instruction ID: 96c1c26bccac540c43fb20adba03f411e1fe60312a713f7a8d8329ebd7208afc
                                                                              • Opcode Fuzzy Hash: e4ca9bb7183159477e85330442c830f61963799a3a423287df70db553be7dc1c
                                                                              • Instruction Fuzzy Hash: 1C017532A3C94286EB44CBA2ECD457B6369EBA4724F442075E54B464B4DE2CF498CB00
                                                                              Function 00007FFE13303A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_$Err_ExceptionObjectState
                                                                              • String ID: UnsupportedDigestmodError$_hashlib.UnsupportedDigestmodError
                                                                              • API String ID: 2341384915-1819944972
                                                                              • Opcode ID: cab25cee2ef474877533d6a272ae1fc29fafa22f63a0b338fcbf87a30af39434
                                                                              • Instruction ID: 5d696f4788c6810408d026b128b4b1a9a3dc964c29495ec49087981b61356779
                                                                              • Opcode Fuzzy Hash: cab25cee2ef474877533d6a272ae1fc29fafa22f63a0b338fcbf87a30af39434
                                                                              • Instruction Fuzzy Hash: 16F06D61718E428AEA128B2AE44017E23A4AF18BF0B585171DD3D267B4DF2CD0848708
                                                                              Function 00007FF7BD3C8A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                              • API String ID: 4061214504-1276376045
                                                                              • Opcode ID: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                                                              • Instruction ID: c647239916c546d9985f5d89d7f9e4c67baf5d8d49787aca7db6d191eab41ae8
                                                                              • Opcode Fuzzy Hash: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                                                              • Instruction Fuzzy Hash: 75F0312561D702C1EA186B18E854379D360AFAB7A1F980239C76D465F9EF2CD1498724
                                                                              Function 00007FFDFB1A1064 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 275stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmovestrncpy
                                                                              • String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
                                                                              • API String ID: 3054264757-3422593365
                                                                              • Opcode ID: 2a13e74aeeda28ae24d471c2d973058ce87a4573439dfd2e625c5b86b5f17ddd
                                                                              • Instruction ID: 9a8d816de8a7cbecacc46cf52e7513c4dba7e46d6d54e4353e9d55074924b739
                                                                              • Opcode Fuzzy Hash: 2a13e74aeeda28ae24d471c2d973058ce87a4573439dfd2e625c5b86b5f17ddd
                                                                              • Instruction Fuzzy Hash: DBB1D422F5AA8786EB10AB55A460B7AB7D0FB44B8CF148035DA6D477EDCE7CE4058B00
                                                                              Function 00007FFDFB1A1762 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 203COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: $$..\s\crypto\rsa\rsa_sign.c
                                                                              • API String ID: 0-1864662394
                                                                              • Opcode ID: 8fbe36633cc90c93da8880bff56d1cee6c4dec6f08620a777a438a0f211b4450
                                                                              • Instruction ID: 09a0d29dbceb7eb199e82323951b94f34be8364feb4a99952037b238266cd1cd
                                                                              • Opcode Fuzzy Hash: 8fbe36633cc90c93da8880bff56d1cee6c4dec6f08620a777a438a0f211b4450
                                                                              • Instruction Fuzzy Hash: F691AE62B0E6C787E720AB15F560BBA62D0FB45B88F104035DAAD07BEADF7CE5458740
                                                                              Function 00007FFDFB1A1ED3 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmove
                                                                              • String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
                                                                              • API String ID: 2162964266-3733131234
                                                                              • Opcode ID: 6cc576c22c478878ec6ca791cb9a6137f743475b9df210abaa33c7174fb92cd2
                                                                              • Instruction ID: 5b5083515d92be66305fe2ffe02a4cb54196daca1528ced6b0ad305717038448
                                                                              • Opcode Fuzzy Hash: 6cc576c22c478878ec6ca791cb9a6137f743475b9df210abaa33c7174fb92cd2
                                                                              • Instruction Fuzzy Hash: 09718362B1E68386E720EB61E460BAA7395FB84798F400135EB6E476DDDF3CE505CB40
                                                                              Function 00007FFDFB1A158C Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 131COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memchr
                                                                              • String ID: ..\s\crypto\x509v3\v3_utl.c$E$FALSE$TRUE
                                                                              • API String ID: 3297308162-1433594941
                                                                              • Opcode ID: a5fc59c9387210eb1afaa89b7669a569dfafa16f6a2f0790f0b1b6bf5b71d08e
                                                                              • Instruction ID: 7f798393286d969460e0c434aed28f5376cce52ef38708501296051ed5719d6d
                                                                              • Opcode Fuzzy Hash: a5fc59c9387210eb1afaa89b7669a569dfafa16f6a2f0790f0b1b6bf5b71d08e
                                                                              • Instruction Fuzzy Hash: 7E51CC22B0BA838AFB14AB529420B6962D0AF48B84F444036DE6D0B7FDDF7CF5558300
                                                                              Function 00007FFE1A45A340 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: NameName::$Name::operator+
                                                                              • String ID:
                                                                              • API String ID: 826178784-0
                                                                              • Opcode ID: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
                                                                              • Instruction ID: b029dc21146869ec79ed8f9616f236c7ab6478d00e32a27ae3c843548e7260f5
                                                                              • Opcode Fuzzy Hash: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
                                                                              • Instruction Fuzzy Hash: 1A415AA2B08F9694EB10EB62D8940B82774BB15FA8F6444F3DA5D533A5DF38E465C300
                                                                              Function 00007FF7BD3D8834 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _set_statfp
                                                                              • String ID:
                                                                              • API String ID: 1156100317-0
                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                              • Instruction ID: e3c27ec6b527f42052d3c2c9959b2106fffc2fe0b8eae23766fc3a14d1e34fa5
                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                              • Instruction Fuzzy Hash: 22114C22E1CA0391F65D312CE466375D0426FB6364EA80A38E77E072DFEE2C7941CB20
                                                                              Function 00007FF7BD3CA9D0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CA9EF
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA0E
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA36
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA47
                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7BD3C9BE3,?,?,00000000,00007FF7BD3C9E7E,?,?,?,?,?,00007FF7BD3C1A50), ref: 00007FF7BD3CAA58
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value
                                                                              • String ID:
                                                                              • API String ID: 3702945584-0
                                                                              • Opcode ID: af209601a09311a3587330aca2a21a13e881bea2e2d7b2dbe8accb447d71c115
                                                                              • Instruction ID: 59194b0d37bfc73cba979a393629374cb6b84439a0779f473ab1b6d942d507bb
                                                                              • Opcode Fuzzy Hash: af209601a09311a3587330aca2a21a13e881bea2e2d7b2dbe8accb447d71c115
                                                                              • Instruction Fuzzy Hash: 76114D14A0C342C2F99C7329A65127AE2415FA77E0F8C963CEA3E476DFFD2CA4118324
                                                                              Function 00007FF7BD3CA864 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA875
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA894
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8BC
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8CD
                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7BD3D24C3,?,?,?,00007FF7BD3CCCFC,?,?,00000000,00007FF7BD3C387F), ref: 00007FF7BD3CA8DE
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Value
                                                                              • String ID:
                                                                              • API String ID: 3702945584-0
                                                                              • Opcode ID: 93f3b8861a56d932bc2e3a1539e3fbd9290d8e2a07b170c6c7e787ab1a2613e4
                                                                              • Instruction ID: 5c27a8d0a23a98b6fa89a3ff85655f900ec52981e6f314d4c528d8e6b6ca2180
                                                                              • Opcode Fuzzy Hash: 93f3b8861a56d932bc2e3a1539e3fbd9290d8e2a07b170c6c7e787ab1a2613e4
                                                                              • Instruction Fuzzy Hash: C311C810E0D30AC2F9AC72695852279D6424FAB3A0E9C563CDB3D5B2CBFD2CB4519735
                                                                              Function 00007FFE148E1000 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740691190.00007FFE148E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740628690.00007FFE148E0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740718938.00007FFE148E2000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740772023.00007FFE148E3000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740797470.00007FFE148E4000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe148e0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Eval_Thread$BuildCreateErr_FromRestoreSaveSequentialSizeUuidValue_Windows
                                                                              • String ID:
                                                                              • API String ID: 170011378-0
                                                                              • Opcode ID: 6b100998d7ddf39f079f4caf39b09ff1818fa8c7589a3d9e3de9bb19b7a62f6b
                                                                              • Instruction ID: a714c42c2b35ab8aba1268966f814a52c2d80cf6a5c8c0c776e2e5432539866e
                                                                              • Opcode Fuzzy Hash: 6b100998d7ddf39f079f4caf39b09ff1818fa8c7589a3d9e3de9bb19b7a62f6b
                                                                              • Instruction Fuzzy Hash: 6201D821A18E4646EA109B52E4C4079A361FF8BBA0F440074FA4E13778DE3DE60C8700
                                                                              Function 00007FFE11ECC8CC Relevance: 7.5, APIs: 5, Instructions: 28stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8D2
                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8E0
                                                                              • strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8FC
                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC904
                                                                              • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC91D
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _errno$getenvstrtoul
                                                                              • String ID:
                                                                              • API String ID: 1872403029-0
                                                                              • Opcode ID: 3e97d55b2a3031ca8e4358d0765d4259702a99d34e6bc1f7ee7be820d9b91776
                                                                              • Instruction ID: 390f9fdb84e9cecdbeb4cffdc2bd433139e5ec20a4b247209b9936b78a1fa73b
                                                                              • Opcode Fuzzy Hash: 3e97d55b2a3031ca8e4358d0765d4259702a99d34e6bc1f7ee7be820d9b91776
                                                                              • Instruction Fuzzy Hash: 8AF01236E09B0287EF114BE29C4537A32A9AF45B71F4490B0D64D077A0DF7DE894C710
                                                                              Function 00007FF7BD3CF228 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _invalid_parameter_noinfo
                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                              • API String ID: 3215553584-1196891531
                                                                              • Opcode ID: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                                                              • Instruction ID: 9cdd842acd2f923cff1bfc5d4412d29f831739f658cae44d336a9dfc89414a46
                                                                              • Opcode Fuzzy Hash: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                                                              • Instruction Fuzzy Hash: 5A819232D0F342D5E76C6E2D8550278E790AB23788FD9407DCB099729FEA2EE5019321
                                                                              Function 00007FFE1A454288 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE
                                                                              • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454407
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort
                                                                              • String ID: $csm$csm
                                                                              • API String ID: 4206212132-1512788406
                                                                              • Opcode ID: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
                                                                              • Instruction ID: 1f72a46c834549d45eb11ed1d147bc08c03d31bb0ee9ea56f6e0bc8d4b14b8c4
                                                                              • Opcode Fuzzy Hash: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
                                                                              • Instruction Fuzzy Hash: 8F71B4B2708A9186D7209F26D44067D7BA1FB05FA8F1481B6DB4D0BAA6CF3CD571C701
                                                                              Function 00007FF7BD3BD478 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CallEncodePointerTranslator
                                                                              • String ID: MOC$RCC
                                                                              • API String ID: 3544855599-2084237596
                                                                              • Opcode ID: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                                                              • Instruction ID: 2491a4b6078eafa01a2e98c327d1514655d89949ec5a1c1c6e85c6e082fb8b79
                                                                              • Opcode Fuzzy Hash: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                                                              • Instruction Fuzzy Hash: 86618D36A08B45CAE7249F69E4403ADF7A0FB55B8CF44012AEF4E17B9ADB78E151C710
                                                                              Function 00007FF7BD3BD7D4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                              • String ID: csm$csm
                                                                              • API String ID: 3896166516-3733052814
                                                                              • Opcode ID: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                                                              • Instruction ID: 053b6a667b65d02205ce1cb63a92c8b126f2bd286cac6245723587ee3abe6c53
                                                                              • Opcode Fuzzy Hash: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                                                              • Instruction Fuzzy Hash: A751A53290C641C6DB78AB19A140368F7A0EB66B84F984139EB9E47B9EDF3CE450C710
                                                                              Function 00007FFE1A45F050 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentImageNonwritableUnwind
                                                                              • String ID: csm$f
                                                                              • API String ID: 451473138-629598281
                                                                              • Opcode ID: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
                                                                              • Instruction ID: 7e831c63e7f39ba5bea0feed3d577344677cbe944ed3091fee3527b0d662808e
                                                                              • Opcode Fuzzy Hash: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
                                                                              • Instruction Fuzzy Hash: FF51D1B6F09A0286DB14EB16E444A3937A5FB44FA8F1081F2EA1E43758DF39ED51C701
                                                                              Function 00007FFE1A454060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE
                                                                              • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454157
                                                                              • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A454167
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Frameabort$EmptyHandler3::StateUnwind
                                                                              • String ID: csm$csm
                                                                              • API String ID: 4108983575-3733052814
                                                                              • Opcode ID: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
                                                                              • Instruction ID: 58992b9c435c5bbc932f50acbf3265273fe226f0ae3696863c92f27f8a329ed3
                                                                              • Opcode Fuzzy Hash: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
                                                                              • Instruction Fuzzy Hash: 995174B6B08B4286EB649B12944427877A1FB55FA4F1441F7DA9D4BBA6CF3CE470CB00
                                                                              Function 00007FFDFB1A2838 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: ..\s\crypto\async\async.c$T
                                                                              • API String ID: 0-2182492907
                                                                              • Opcode ID: d429df3d22b628225212d233b30d019ad47286c3daee9723a66c5744efd77ded
                                                                              • Instruction ID: bf106e025ae16d82291163fa321f049f98aceed43dcf0bfded20e0170c4b1da3
                                                                              • Opcode Fuzzy Hash: d429df3d22b628225212d233b30d019ad47286c3daee9723a66c5744efd77ded
                                                                              • Instruction Fuzzy Hash: 2751BF32B0A64386E724AB65D460AB977A1EF84B84F004031DA6D4BBFDDF3CF5188740
                                                                              Function 00007FFE1A45AAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: NameName::
                                                                              • String ID: %lf
                                                                              • API String ID: 1333004437-2891890143
                                                                              • Opcode ID: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
                                                                              • Instruction ID: ce0494d6ca2f1158f8dd5910f0907ff8ce922109df9029a0d76a768f3fce7af2
                                                                              • Opcode Fuzzy Hash: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
                                                                              • Instruction Fuzzy Hash: C431D3A1B08F8685E621EB13A8510B9B360BF45FA0F4481F7EA6E57771DF3CE1658740
                                                                              Function 00007FFDFB1A4E9E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: BIO[%p]: $bio callback - unknown type (%d)
                                                                              • API String ID: 0-3830480438
                                                                              • Opcode ID: 37402eaaac69d4977c204fa2d8aacd64ee20ba5ad1b9fa36187e989d609f7c14
                                                                              • Instruction ID: acd48971cdfbf3ba7f83f04186f6f04735a4d2818944521678bb961ca12ccba5
                                                                              • Opcode Fuzzy Hash: 37402eaaac69d4977c204fa2d8aacd64ee20ba5ad1b9fa36187e989d609f7c14
                                                                              • Instruction Fuzzy Hash: 58312863B0A68346FB119B59AC60FBA6755BF89788F504131EE1E877E9EE3CE445C200
                                                                              Function 00007FFDFB1A3846 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: ..\s\crypto\bio\b_sock.c$J$host=
                                                                              • API String ID: 0-1729655730
                                                                              • Opcode ID: 941f2fbceea9f6781c3ad95e534017a9b341198856a0048fa999bb3705f921b3
                                                                              • Instruction ID: cde7727360e0aa5638d33a08f2593e7975f163d5cff832fea9ed28043a13e077
                                                                              • Opcode Fuzzy Hash: 941f2fbceea9f6781c3ad95e534017a9b341198856a0048fa999bb3705f921b3
                                                                              • Instruction Fuzzy Hash: 69318E22B0964286EB109B55F460AAEA364FB85794F400035EBAC87BEEDE3DE5558B00
                                                                              Function 00007FFE11EC8458 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: BuildDeallocTuple_Value
                                                                              • String ID: (iiO&N)
                                                                              • API String ID: 2051921541-152595445
                                                                              • Opcode ID: 7823d2b72ccc724d5a661d7deb3397bc2856816dbaecbfd8ca80badbcaec080f
                                                                              • Instruction ID: 5c4faa818bb18f2d1cb2e1ea3db5eac208e733bcef270944315d04223f543e0e
                                                                              • Opcode Fuzzy Hash: 7823d2b72ccc724d5a661d7deb3397bc2856816dbaecbfd8ca80badbcaec080f
                                                                              • Instruction Fuzzy Hash: 16213B32A04F4286EB24CB96ED4056AB7A8FB58BA0B494575DA9E43B74DF3CF441C740
                                                                              Function 00007FFDFB1A139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLastsocket
                                                                              • String ID: ..\s\crypto\bio\b_sock2.c$2
                                                                              • API String ID: 1120909799-2051290508
                                                                              • Opcode ID: b87478d39e550b6278b10c6495ad9d7c2480af2d970ddb1f34380d70319f0b12
                                                                              • Instruction ID: 884f1c7849c75b6f1f4541bc5a9b24cd90feb00333cdeb65c00f2471137a98ba
                                                                              • Opcode Fuzzy Hash: b87478d39e550b6278b10c6495ad9d7c2480af2d970ddb1f34380d70319f0b12
                                                                              • Instruction Fuzzy Hash: 8401E932B0919386E3109B25E4209AE6265FB407A8F204231E27C87AE9CF3CE9158B80
                                                                              Function 00007FF7BD3B2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7BD3B27C9,?,?,?,?,?,?), ref: 00007FF7BD3B2D01
                                                                                • Part of subcall function 00007FF7BD3B1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7BD3B6914,?,?,?,?,?,?,?,?,?,?,?,00007FF7BD3B1023), ref: 00007FF7BD3B1CD7
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastModuleName
                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                              • API String ID: 2776309574-1977442011
                                                                              • Opcode ID: 03418fa9b2e628d931ab4da9c5673be06a47612831d463e21a3e8fef2e510276
                                                                              • Instruction ID: 27384000befb7e05524c57c3c5200b51ba7d392859e3654e7c3acc8a16e0f3ef
                                                                              • Opcode Fuzzy Hash: 03418fa9b2e628d931ab4da9c5673be06a47612831d463e21a3e8fef2e510276
                                                                              • Instruction Fuzzy Hash: 4D017520B1D642D1FA69B728D4553B5E251AF7A380FC0003DEA4D872AFFE1CE145C724
                                                                              Function 00007FFE1A452630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE
                                                                              • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45266E
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abortterminate
                                                                              • String ID: MOC$RCC$csm
                                                                              • API String ID: 661698970-2671469338
                                                                              • Opcode ID: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
                                                                              • Instruction ID: 1406a3691859c820e7c6b7b2eb8b42ec6b3705f1f4027804d61b479fb79fc8c7
                                                                              • Opcode Fuzzy Hash: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
                                                                              • Instruction Fuzzy Hash: 5FF03CB2A18A0682E7506B66A18117877A4EF48F64F0951F3DB4806266CF3CD4B0CA41
                                                                              Function 00007FFE13305F50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: D_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
                                                                              • String ID: <%U HMAC object @ %p>
                                                                              • API String ID: 3107003933-749664232
                                                                              • Opcode ID: 823f7f4223b6ea06d6d4820c057e660dc204683fd4f0f0d394d23a59cb4c9db1
                                                                              • Instruction ID: 484be0da5edbf146bc4132642b7f1770439c00ad417ac1d8a7715f2442c7b8d3
                                                                              • Opcode Fuzzy Hash: 823f7f4223b6ea06d6d4820c057e660dc204683fd4f0f0d394d23a59cb4c9db1
                                                                              • Instruction Fuzzy Hash: 72F0A021B09F4289EE059B27F90417D63A0AF68FE0B480470ED2E277B4DE3CE4408308
                                                                              Function 00007FFE13305844 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: D_typeDeallocFormatFromJ_nid2lnUnicode_X_get_md
                                                                              • String ID: hmac-%U
                                                                              • API String ID: 3107003933-3757664071
                                                                              • Opcode ID: 38543325c9a58b19710b73aaee43961f9cfd1a21f3fd3a664d110f44dce9644c
                                                                              • Instruction ID: fb2036c386526f9938cf719e274a4a12c4e5c08f6bd0f543429df85c673b50a1
                                                                              • Opcode Fuzzy Hash: 38543325c9a58b19710b73aaee43961f9cfd1a21f3fd3a664d110f44dce9644c
                                                                              • Instruction Fuzzy Hash: B4F06521F19E06C5EE199B67E85417C6391BF68BE1B481470DD2E277B4DE2CE0418348
                                                                              Function 00007FFDFB3C9C10 Relevance: 6.5, APIs: 5, Instructions: 232COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memcmp
                                                                              • String ID:
                                                                              • API String ID: 1475443563-0
                                                                              • Opcode ID: ca894cce3bd78d2642ea1bcb458eb66fcd1cc6eb7eacde8df9891b13e2823d55
                                                                              • Instruction ID: 0ba404c9d708b7a499d51352c8edab62d19b103275ed0af18fdd4a51c1285d8b
                                                                              • Opcode Fuzzy Hash: ca894cce3bd78d2642ea1bcb458eb66fcd1cc6eb7eacde8df9891b13e2823d55
                                                                              • Instruction Fuzzy Hash: E891B5B2F4A65386FB11ABA6C9609BD23E5BF41788F415131DE1D5BAEDEE38E405C300
                                                                              Function 00007FFDFB1A643D Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 395COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memset
                                                                              • String ID: ..\s\crypto\sm2\sm2_crypt.c$@
                                                                              • API String ID: 2221118986-485510600
                                                                              • Opcode ID: 59937788e76babb823402f7aa2bb2dcd071829aef404cc5ed2f3e2b9851a66de
                                                                              • Instruction ID: c86b759d7430b95b5fbdf90c51fe496e166ed867e3d9125e38b5d04dfb03c5d8
                                                                              • Opcode Fuzzy Hash: 59937788e76babb823402f7aa2bb2dcd071829aef404cc5ed2f3e2b9851a66de
                                                                              • Instruction Fuzzy Hash: 7A029333B4AB8386EB20EB55E4609B967A1FB85B84F408135DA9C077E9DF3DE505CB40
                                                                              Function 00007FF7BD3CBBE0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                              • String ID:
                                                                              • API String ID: 2718003287-0
                                                                              • Opcode ID: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                                                              • Instruction ID: a9cb4ea5f669012141e1e3486195a00278acf6da7f37215adf90e947c09d2117
                                                                              • Opcode Fuzzy Hash: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                                                              • Instruction Fuzzy Hash: ECD1F072B08B85C9E714DF69D4401ACB7B1FB25798B884239CF4E57B9AEE38E046C710
                                                                              Function 00007FFDFB1A3832 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 226COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: )$..\s\crypto\evp\p5_crpt.c
                                                                              • API String ID: 0-3563398421
                                                                              • Opcode ID: 3447cb7305a06ee0e73fa9c8685d2ef131f742793ef80daca158727beab2407e
                                                                              • Instruction ID: 30d59bb6838dc12fa6723c8a85c04db02f2638dcf00bfe2f7ebf3d35f85597b5
                                                                              • Opcode Fuzzy Hash: 3447cb7305a06ee0e73fa9c8685d2ef131f742793ef80daca158727beab2407e
                                                                              • Instruction Fuzzy Hash: D1918362F4E28787FB20AB25A420ABA6394EF85784F444131DE6D4B6EDDF3CF5458700
                                                                              Function 00007FFE1A45A058 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID:
                                                                              • API String ID: 2943138195-0
                                                                              • Opcode ID: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
                                                                              • Instruction ID: 7cffc8259f363674fcbccbc7fddc10bcbe89d4e6fa2fc52a99d6043b0db07be4
                                                                              • Opcode Fuzzy Hash: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
                                                                              • Instruction Fuzzy Hash: AD9159A2F08B9289FB119B62D8453BC27B1BB04B28F5480F7DA4D576A5DF3CA865C340
                                                                              Function 00007FF7BD3CE96C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_isindst
                                                                              • String ID:
                                                                              • API String ID: 4170891091-0
                                                                              • Opcode ID: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                                                              • Instruction ID: b3e3ed580e8b1492829c924ad517ca4eaa5adbd984c187ed48e21132101f0ad5
                                                                              • Opcode Fuzzy Hash: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                                                              • Instruction Fuzzy Hash: BA51F972F0D311CAEB1CEF28995167CE765AB21359F94013DEF1E636DAEB38A4118710
                                                                              Function 00007FFDFB1A153C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmove
                                                                              • String ID: ..\s\crypto\ct\ct_oct.c
                                                                              • API String ID: 2162964266-1972679481
                                                                              • Opcode ID: 30f54181be1fc9f89472802893a00c732398e9ac6cccc628088a92dc21b80f1c
                                                                              • Instruction ID: 1ebe675179b90036c8e8c0784d6c02a0225b29fdb9ccf35a943a9a48aff63878
                                                                              • Opcode Fuzzy Hash: 30f54181be1fc9f89472802893a00c732398e9ac6cccc628088a92dc21b80f1c
                                                                              • Instruction Fuzzy Hash: 4971D362B0E69399E711CF26C0205BC3B71EB15B88F144132DEAD8B7EADE2CE655C700
                                                                              Function 00007FFDFB253690 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strncmp
                                                                              • String ID: content-type
                                                                              • API String ID: 1114863663-3266185539
                                                                              • Opcode ID: bf53f0bda5b18ea8a6db5564624a96e5e23242bcbab55d1f3e52cd3e6e3dc342
                                                                              • Instruction ID: b863f3c4b89ce2e80c482edf5d1890067b2cdd7990dd16cbccca29dc1557caeb
                                                                              • Opcode Fuzzy Hash: bf53f0bda5b18ea8a6db5564624a96e5e23242bcbab55d1f3e52cd3e6e3dc342
                                                                              • Instruction Fuzzy Hash: 71511852F2E64341FB249726A5B0BBA5294BF45B9CF442630DD7EC76EDDE2CE5018300
                                                                              Function 00007FFE1A45A814 Relevance: 6.1, APIs: 4, Instructions: 133COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+$NameName::
                                                                              • String ID:
                                                                              • API String ID: 168861036-0
                                                                              • Opcode ID: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
                                                                              • Instruction ID: a1e437d170aa1544db8bc42d17c7c28063bf885a19cfb1ec2374dab86c07ae47
                                                                              • Opcode Fuzzy Hash: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
                                                                              • Instruction Fuzzy Hash: 055179B2B18F6689E711DF22D8443BC37A0BB44F64F1448B2DA1D477A5DF38A460C740
                                                                              Function 00007FF7BD3C484C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                              • String ID:
                                                                              • API String ID: 2780335769-0
                                                                              • Opcode ID: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                                                              • Instruction ID: e3dfa5a85605567d9155ec7b302fe11245d513346fec6761870e2eb321187fbd
                                                                              • Opcode Fuzzy Hash: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                                                              • Instruction Fuzzy Hash: D8519F22A0C752C5FB58EF68D4503BDA3A1AB66B48F548538DF4D5768EEF38E4808720
                                                                              Function 00007FFE1A45CC48 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+$Replicator::operator[]
                                                                              • String ID:
                                                                              • API String ID: 3863519203-0
                                                                              • Opcode ID: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
                                                                              • Instruction ID: 808aaa399ed648a811891340229277dda68c3743c18f443813332c5838aa8627
                                                                              • Opcode Fuzzy Hash: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
                                                                              • Instruction Fuzzy Hash: FE4164B2B08B8589EB01DF65D8403BC3BB0BB45B68F5481B6DA4D97769DF3C9861C740
                                                                              Function 00007FFE11EB1420 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$DefaultDescr_Dict_
                                                                              • String ID:
                                                                              • API String ID: 2801783965-0
                                                                              • Opcode ID: 0cb0a0d7c4dba4ba2394bbe7a91d855d4f8c3687e99bccf36430c39352716f8a
                                                                              • Instruction ID: 90353a2f780a4263c7e878e93e8c442a1cb473e77eb4b72ee85e1ae7fe7684f9
                                                                              • Opcode Fuzzy Hash: 0cb0a0d7c4dba4ba2394bbe7a91d855d4f8c3687e99bccf36430c39352716f8a
                                                                              • Instruction Fuzzy Hash: DA213736A09F4285EB548B96EC4026A33A8FB49FB1F595176DA4E43760EF3CE481C344
                                                                              Function 00007FFDFB1A1C76 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57stringCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: strcmp
                                                                              • String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
                                                                              • API String ID: 1004003707-3633731555
                                                                              • Opcode ID: 4572dd0f7fa3ae89848ab64a9b5a8af87d8caaf2ece5ebb710d7e1f4848d8ae1
                                                                              • Instruction ID: eb055c88ce7867ca77b52f1b355b93ed4cec744862b4b56b4a92304a7123e51d
                                                                              • Opcode Fuzzy Hash: 4572dd0f7fa3ae89848ab64a9b5a8af87d8caaf2ece5ebb710d7e1f4848d8ae1
                                                                              • Instruction Fuzzy Hash: 5221A922B0AA4781EB10EB55E4209A963A4FF84798F404031EA9C477EDDF7DF154CB00
                                                                              Function 00007FFDFB1A440D Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmovememset
                                                                              • String ID: $$..\s\crypto\rsa\rsa_none.c
                                                                              • API String ID: 1288253900-779172340
                                                                              • Opcode ID: de5f583c7a3756590fc2426c2a0cc6b33ad44590f8bf8e756a1bf535920b5d69
                                                                              • Instruction ID: b7ddf763a9f9465602fcf8bcee3a5834d2f4e0f5f8b3d9e340d431076dc132a2
                                                                              • Opcode Fuzzy Hash: de5f583c7a3756590fc2426c2a0cc6b33ad44590f8bf8e756a1bf535920b5d69
                                                                              • Instruction Fuzzy Hash: B301F122F1924387E710EF26A9504A9A7A1EB84780F188530FB6C07BEECF3CE1058700
                                                                              Function 00007FFE11EB2098 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$AttrFromLongLong_Object_String
                                                                              • String ID:
                                                                              • API String ID: 391580422-0
                                                                              • Opcode ID: 9a338a268811a4e858a024dc520ceb1571b8b14ee28904e10b92bbda1fa405e7
                                                                              • Instruction ID: 3b80a09af79439dd5c6a1a30984613c57673a74206d77f82e6ed1118cdd50c4b
                                                                              • Opcode Fuzzy Hash: 9a338a268811a4e858a024dc520ceb1571b8b14ee28904e10b92bbda1fa405e7
                                                                              • Instruction Fuzzy Hash: B7012C31A1EF4382EF144B97AC0013A6299AF49FB0F585571E94E577B4DE2CE482C304
                                                                              Function 00007FF7BD3BA920 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                              • String ID:
                                                                              • API String ID: 2933794660-0
                                                                              • Opcode ID: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                                                              • Instruction ID: 6288fe12811421a8e06ab3f27ac4ff6fb891c1ad4a21f938270666553730db28
                                                                              • Opcode Fuzzy Hash: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                                                              • Instruction Fuzzy Hash: D7114F22B18F01CAEB00DF64E8542A8B3A4F729758F840D35DB6D477A9EF78D1548350
                                                                              Function 00007FFE11EBF4F8 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Dealloc$Module_State
                                                                              • String ID:
                                                                              • API String ID: 3434497292-0
                                                                              • Opcode ID: 292c251840d4f5b8aa219338b90566aef11cb9e2afb7bce25e29caef6a64fe2b
                                                                              • Instruction ID: 4bb7223db6d382b2fe98d4aee4d2bf98348d40269e02870ded3554dad88b7632
                                                                              • Opcode Fuzzy Hash: 292c251840d4f5b8aa219338b90566aef11cb9e2afb7bce25e29caef6a64fe2b
                                                                              • Instruction Fuzzy Hash: F301D676D0AD0382EB598FF69C5833A22A8BF44F24F1855B2C91E055B08F2EAD818316
                                                                              Function 00007FFE13302460 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: D_typeJ_nid2lnJ_nid2snX_md
                                                                              • String ID:
                                                                              • API String ID: 1665016204-0
                                                                              • Opcode ID: ed77c7e200b5a299f4367d3d5b17755c8672caa46e550946c74c720bbe9b0c91
                                                                              • Instruction ID: 180dda91b5648a1aecfe912491c486ecec372a01cce43197735d5fbc8a8e650a
                                                                              • Opcode Fuzzy Hash: ed77c7e200b5a299f4367d3d5b17755c8672caa46e550946c74c720bbe9b0c91
                                                                              • Instruction Fuzzy Hash: 0801C921E09E028AFF5A5B62985433D22A0AF68B76F1415B9C52E653F1DF3CA4858348
                                                                              Function 00007FFE13302860 Relevance: 6.0, APIs: 4, Instructions: 24COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocErr_MemoryObject_X_new
                                                                              • String ID:
                                                                              • API String ID: 30467670-0
                                                                              • Opcode ID: ff40f30a92d5eed2e742e76349bf853d5a257016a328a92baeabcb4a8d59bfb5
                                                                              • Instruction ID: 667bf0405b650e40888ea38738b5c4f7fb58dfec7cbb91be58c0c89a0b76d244
                                                                              • Opcode Fuzzy Hash: ff40f30a92d5eed2e742e76349bf853d5a257016a328a92baeabcb4a8d59bfb5
                                                                              • Instruction Fuzzy Hash: B0F0C025D1DF0389FF6A5B63A84433C22A4AF29B62F0C14B4C92E653B0DF3CA4548358
                                                                              Function 00007FFE13305E74 Relevance: 6.0, APIs: 4, Instructions: 21threadCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocFreeObject_Thread_free_lockX_free
                                                                              • String ID:
                                                                              • API String ID: 133976240-0
                                                                              • Opcode ID: 57730f3bc79dfce44f660b9b0e6df719bd62e154393204126429c72edc4f63f9
                                                                              • Instruction ID: b82d12141f49e4b8e93a08f3514cc9d274ee113f8e69e6c34aed9f990f67eb43
                                                                              • Opcode Fuzzy Hash: 57730f3bc79dfce44f660b9b0e6df719bd62e154393204126429c72edc4f63f9
                                                                              • Instruction Fuzzy Hash: 4DE0C035A19E42C9FB199F67E55407D2320EF58FA5B185070DE6E16274CF3CD495C348
                                                                              Function 00007FFDFB1A6A23 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMON
                                                                              Download Yara Rule
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID: ..\s\crypto\engine\eng_ctrl.c$b
                                                                              • API String ID: 0-1836817417
                                                                              • Opcode ID: 2f64efd3c35e40f30812e63d939679b1a2fc46fb0eca14743626378916f2d28d
                                                                              • Instruction ID: 5cd106947d015be296decfd18a45a7b125747a9df5399258be1518fbbfaf1e4b
                                                                              • Opcode Fuzzy Hash: 2f64efd3c35e40f30812e63d939679b1a2fc46fb0eca14743626378916f2d28d
                                                                              • Instruction Fuzzy Hash: C1E18222B4EA4383F7649B11D520B7936A1BF84788F184135EAAD07AEDCF3CF9459741
                                                                              Function 00007FF7BD3D4DCC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                              • String ID: ?
                                                                              • API String ID: 1286766494-1684325040
                                                                              • Opcode ID: d9780ce076add9e9831f1cfb185e72a00ff476f32ad1e0024c6e5aca1437e75c
                                                                              • Instruction ID: d17d9ba8bb0e8347fdc6c9ddac3e3dc2d5c432fb368b4154733dda25059e991a
                                                                              • Opcode Fuzzy Hash: d9780ce076add9e9831f1cfb185e72a00ff476f32ad1e0024c6e5aca1437e75c
                                                                              • Instruction Fuzzy Hash: 3341D812A1C38395FB686729A451379D650EBA2BA4F544239EF5C07ADEFE3CD441CB10
                                                                              Function 00007FFDFB1A2748 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _time64
                                                                              • String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
                                                                              • API String ID: 1670930206-2648760357
                                                                              • Opcode ID: 4f01d9f861e9c6c8f70647b046dc82b808f72db07d97631f436a9c698cc874c8
                                                                              • Instruction ID: 1ad08c35f579d7e45ae1cf077c7b430c292fae4d404f848a316af32f89027961
                                                                              • Opcode Fuzzy Hash: 4f01d9f861e9c6c8f70647b046dc82b808f72db07d97631f436a9c698cc874c8
                                                                              • Instruction Fuzzy Hash: 4B519372F097828AE760DF18E45066AB7A0FB8A744F544131EA9D87BADDF3CE5408F00
                                                                              Function 00007FFDFB1A1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: getaddrinfo
                                                                              • String ID: ..\s\crypto\bio\b_addr.c
                                                                              • API String ID: 300660673-2547254400
                                                                              • Opcode ID: a2c99f71c7972fb3b7ba828c59694e00382d0b8ec626129309ba30accd8ab733
                                                                              • Instruction ID: dd2f73f51ec438dfea23aa656f9fe1133f9f0da079aece3d0b5a6fa913ebca8d
                                                                              • Opcode Fuzzy Hash: a2c99f71c7972fb3b7ba828c59694e00382d0b8ec626129309ba30accd8ab733
                                                                              • Instruction Fuzzy Hash: F6410772B196838BE7119B22A850AF9B791FB84744F004135EA9987BE9DF3CE8458F40
                                                                              Function 00007FFE1A4549B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: abort$CreateFrameInfo
                                                                              • String ID: csm
                                                                              • API String ID: 2697087660-1018135373
                                                                              • Opcode ID: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
                                                                              • Instruction ID: ddd726ff11c4f69a2b64972a1da2433f4786721e8ed4bd159520cc3cc2a0e7ae
                                                                              • Opcode Fuzzy Hash: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
                                                                              • Instruction Fuzzy Hash: 20511CB6718B4186E660AB16E44027E77B4F788FA0F1405B6DB8D07B66DF3CE465CB40
                                                                              Function 00007FF7BD3C7FE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BD3C8012
                                                                                • Part of subcall function 00007FF7BD3C9F88: HeapFree.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9F9E
                                                                                • Part of subcall function 00007FF7BD3C9F88: GetLastError.KERNEL32(?,?,?,00007FF7BD3D1ED2,?,?,?,00007FF7BD3D1F0F,?,?,00000000,00007FF7BD3D23D5,?,?,00000000,00007FF7BD3D2307), ref: 00007FF7BD3C9FA8
                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7BD3BA495), ref: 00007FF7BD3C8030
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                              • String ID: C:\Users\user\Desktop\PDF_Resave.exe
                                                                              • API String ID: 3580290477-2412123782
                                                                              • Opcode ID: 6d7d95bebc1c7e9c2ca04ba4a518ba82f51154095bcf1e32176823eeda0f2bff
                                                                              • Instruction ID: b04708d4d979ec27fb3d421536f1bc1447a313af7229441e7e5bdac0ce27de34
                                                                              • Opcode Fuzzy Hash: 6d7d95bebc1c7e9c2ca04ba4a518ba82f51154095bcf1e32176823eeda0f2bff
                                                                              • Instruction Fuzzy Hash: A7418136A0C716D5EB1CAF2998500B9E694EF56780F994039EB4D03B8BEF39E5858320
                                                                              Function 00007FF7BD3CC278 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorFileLastWrite
                                                                              • String ID: U
                                                                              • API String ID: 442123175-4171548499
                                                                              • Opcode ID: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                                                              • Instruction ID: f190a49516a6666e16bcd2807a639ab5eee144e43fa92977ca968a1be397fd67
                                                                              • Opcode Fuzzy Hash: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                                                              • Instruction Fuzzy Hash: 87419132A1CB41C1DB649F29E8443A9E760FBA9794F884039EB4D87799EF3CD441C710
                                                                              Function 00007FFE11EBC560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DeallocErr_String
                                                                              • String ID: Cannot delete attribute
                                                                              • API String ID: 1259552197-1790985853
                                                                              • Opcode ID: de2af97183b5ab665fbd892aa82625e99ad3be16cb07556211671bbe331626aa
                                                                              • Instruction ID: aa569b6edee327bda632d673f9cf74f9b989a24f7f5042f662488e24798de991
                                                                              • Opcode Fuzzy Hash: de2af97183b5ab665fbd892aa82625e99ad3be16cb07556211671bbe331626aa
                                                                              • Instruction Fuzzy Hash: F8318F76B09E4286EB648B97EC4026A6368FF48BB4F1851B2DA1E47B74CF3DE4518704
                                                                              Function 00007FFE1A459F44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Name::operator+
                                                                              • String ID: void$void
                                                                              • API String ID: 2943138195-3746155364
                                                                              • Opcode ID: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
                                                                              • Instruction ID: 875731d20529edb4b255745a62000598e67eb6746bd7be3a9cadca225dcbe56d
                                                                              • Opcode Fuzzy Hash: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
                                                                              • Instruction Fuzzy Hash: 223146A2F18B5598FB01DFA1E8410FC37B0BB48B58B4405B6EA4EA3B69DF3C9164C750
                                                                              Function 00007FF7BD3CE598 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentDirectory
                                                                              • String ID: :
                                                                              • API String ID: 1611563598-336475711
                                                                              • Opcode ID: 132199adc714e9629c61c67295dcba21de8455e3cfff0b1badab354436fabe04
                                                                              • Instruction ID: c2cf92d24edbd2137cc49e877df280306f526e7003ea89c126b4233fa3620c2a
                                                                              • Opcode Fuzzy Hash: 132199adc714e9629c61c67295dcba21de8455e3cfff0b1badab354436fabe04
                                                                              • Instruction Fuzzy Hash: 11210622B1C781C1EB28AB19D04426DF3A1FBA5B44FC9403DD74D1328AEF7CE9658B60
                                                                              Function 00007FFE13302B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyObject_IsTrue.PYTHON311 ref: 00007FFE13302BEB
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE13301063
                                                                                • Part of subcall function 00007FFE13301000: _Py_hashtable_get.PYTHON311 ref: 00007FFE13301073
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_flags.LIBCRYPTO-1_1 ref: 00007FFE133010A7
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE133010B8
                                                                                • Part of subcall function 00007FFE13301000: _PyObject_New.PYTHON311 ref: 00007FFE133010C1
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFE133010D3
                                                                                • Part of subcall function 00007FFE13301000: EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFE133010FB
                                                                              • _PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE13302C3B
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_Object_State$Arg_D_flagsDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
                                                                              • String ID: sha256
                                                                              • API String ID: 3901364687-1556616439
                                                                              • Opcode ID: 8605687528c92a14fcc0294d2b696536008bcb8e906118a4c96b97f44988ac05
                                                                              • Instruction ID: a34a448ab0fa928c03317823f8f6114615e24435948aa0b3be2653a6d44a09b8
                                                                              • Opcode Fuzzy Hash: 8605687528c92a14fcc0294d2b696536008bcb8e906118a4c96b97f44988ac05
                                                                              • Instruction Fuzzy Hash: 8721B032A09F418AEE648F13E44066DA2A4FF68BE4F094170EE6DA3764DF7DD440C704
                                                                              Function 00007FFE13303270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyObject_IsTrue.PYTHON311 ref: 00007FFE133032EB
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE13301063
                                                                                • Part of subcall function 00007FFE13301000: _Py_hashtable_get.PYTHON311 ref: 00007FFE13301073
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_flags.LIBCRYPTO-1_1 ref: 00007FFE133010A7
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE133010B8
                                                                                • Part of subcall function 00007FFE13301000: _PyObject_New.PYTHON311 ref: 00007FFE133010C1
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFE133010D3
                                                                                • Part of subcall function 00007FFE13301000: EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFE133010FB
                                                                              • _PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE1330333B
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_Object_State$Arg_D_flagsDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
                                                                              • String ID: sha3_256
                                                                              • API String ID: 3901364687-59190292
                                                                              • Opcode ID: c67b15245a0b545474ba9a20e3969ec6ab456242c73f3d5027aae6fae515f439
                                                                              • Instruction ID: d5a930b219ec0978b8890533fb29618426519f774b70261b3f87cecd43882f13
                                                                              • Opcode Fuzzy Hash: c67b15245a0b545474ba9a20e3969ec6ab456242c73f3d5027aae6fae515f439
                                                                              • Instruction Fuzzy Hash: 4F21C232B08F418AEE608B13E4406AE62A8FB68BE4F184170EE6D63764DF3CD900C704
                                                                              Function 00007FFE13303350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyObject_IsTrue.PYTHON311 ref: 00007FFE133033CB
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE13301063
                                                                                • Part of subcall function 00007FFE13301000: _Py_hashtable_get.PYTHON311 ref: 00007FFE13301073
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_flags.LIBCRYPTO-1_1 ref: 00007FFE133010A7
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE133010B8
                                                                                • Part of subcall function 00007FFE13301000: _PyObject_New.PYTHON311 ref: 00007FFE133010C1
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFE133010D3
                                                                                • Part of subcall function 00007FFE13301000: EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFE133010FB
                                                                              • _PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE1330341B
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_Object_State$Arg_D_flagsDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
                                                                              • String ID: sha3_224
                                                                              • API String ID: 3901364687-2731072511
                                                                              • Opcode ID: 56e49af4b8ea5246fdcc7845f3c1ff5b02ac791c8e8e097f65d51e2a5707a248
                                                                              • Instruction ID: f08fccf590dedf8ff2c2cd3d1c9fba338e3628e0fdb993dfa15ee199153b9e47
                                                                              • Opcode Fuzzy Hash: 56e49af4b8ea5246fdcc7845f3c1ff5b02ac791c8e8e097f65d51e2a5707a248
                                                                              • Instruction Fuzzy Hash: 2A21C832B19F418AEE60CB23E48066E6294FB68BE4F1C41B1DE6D53764DF7CD4008744
                                                                              Function 00007FFE13302C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • PyObject_IsTrue.PYTHON311 ref: 00007FFE13302CCB
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE13301063
                                                                                • Part of subcall function 00007FFE13301000: _Py_hashtable_get.PYTHON311 ref: 00007FFE13301073
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_flags.LIBCRYPTO-1_1 ref: 00007FFE133010A7
                                                                                • Part of subcall function 00007FFE13301000: PyModule_GetState.PYTHON311 ref: 00007FFE133010B8
                                                                                • Part of subcall function 00007FFE13301000: _PyObject_New.PYTHON311 ref: 00007FFE133010C1
                                                                                • Part of subcall function 00007FFE13301000: EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFE133010D3
                                                                                • Part of subcall function 00007FFE13301000: EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFE133010FB
                                                                              • _PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE13302D1B
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740521667.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740496540.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740547562.00007FFE13307000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740573296.00007FFE1330C000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740602702.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe13300000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Module_Object_State$Arg_D_flagsDigestInit_exKeywordsPy_hashtable_getTrueUnpackX_new
                                                                              • String ID: md5
                                                                              • API String ID: 3901364687-3899452385
                                                                              • Opcode ID: 980258609fd57627985029a1359037be3026fba797028a88728b7d60e3954ae3
                                                                              • Instruction ID: 88691f3c74635bb3b137fad796518c790e2d0924671ec2be90b544d4ad386b5c
                                                                              • Opcode Fuzzy Hash: 980258609fd57627985029a1359037be3026fba797028a88728b7d60e3954ae3
                                                                              • Instruction Fuzzy Hash: B121C232A08F428AEE61CB13E40066D62A4FB68BD4F194171EE6DA7764DF3ED8408748
                                                                              Function 00007FFDFB1A338C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLastgetsockname
                                                                              • String ID: ..\s\crypto\bio\b_sock.c
                                                                              • API String ID: 566540725-540685895
                                                                              • Opcode ID: 6b4fc8a7a88fb01f9812228e0b07841756f3377f257988557045c535e6cc1a7b
                                                                              • Instruction ID: ee998cf734aad2fc31051bd79425c3e3175c97fcf563b671fa82e5d2fff22ce4
                                                                              • Opcode Fuzzy Hash: 6b4fc8a7a88fb01f9812228e0b07841756f3377f257988557045c535e6cc1a7b
                                                                              • Instruction Fuzzy Hash: 98218072B0910786E720DB60D820AEE77A0EF84718F404135E66C46AF8DF7DF599DB40
                                                                              Function 00007FFDFB1A2522 Relevance: 5.3, APIs: 4, Instructions: 301COMMON
                                                                              Download Yara Rule
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID:
                                                                              • String ID:
                                                                              • API String ID:
                                                                              • Opcode ID: 904c1ddc1ac2b7d51a3733fdc4c934fa97721c2ab28c691eea5c0e6f115cc51a
                                                                              • Instruction ID: 4fe10b373ad06de8bcd10f55e396b9559588ed2a25e5a8c0cfc23a7b3c71c47a
                                                                              • Opcode Fuzzy Hash: 904c1ddc1ac2b7d51a3733fdc4c934fa97721c2ab28c691eea5c0e6f115cc51a
                                                                              • Instruction Fuzzy Hash: 4AC1B572B0968186D720DF59A450BAEB7A5FB89BC4F044136EE4D97B9DDF3CE0058B40
                                                                              Function 00007FFE1A4562EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: FileHeader$ExceptionRaise
                                                                              • String ID: Access violation - no RTTI data!$Bad dynamic_cast!
                                                                              • API String ID: 3685223789-3176238549
                                                                              • Opcode ID: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
                                                                              • Instruction ID: e172b658535d01e83bd57d5162ab50a7ca66e582ba5a7e9cdacb51fc8cdf2ccc
                                                                              • Opcode Fuzzy Hash: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
                                                                              • Instruction Fuzzy Hash: F0015EA1B29E8691EE40AB16F450178A321FF40FA4F4850F3E65E07675EF6CE564C700
                                                                              Function 00007FFE1A456690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFileHeaderRaise
                                                                              • String ID: csm
                                                                              • API String ID: 2573137834-1018135373
                                                                              • Opcode ID: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
                                                                              • Instruction ID: 7bc0cbed7bf8ecaba938c7922a3b33647ad9e37d51fd8fc8727a111cf8f43bc5
                                                                              • Opcode Fuzzy Hash: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
                                                                              • Instruction Fuzzy Hash: 52113D72608F8182EB108F16F440269B7A5FB88F94F1842B6DF8C07B68DF3DD5658700
                                                                              Function 00007FF7BD3BE320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ExceptionFileHeaderRaise
                                                                              • String ID: csm
                                                                              • API String ID: 2573137834-1018135373
                                                                              • Opcode ID: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                                                              • Instruction ID: 64289bdfc823a9ddaa8e3dd3567965a6a858180e18b3cfcba344a957ba26770c
                                                                              • Opcode Fuzzy Hash: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                                                              • Instruction Fuzzy Hash: A6113A3260CB4182EB259F19E540269F7A1FB99B84F584238EF8D07769EF3CD551CB40
                                                                              Function 00007FFE11EBB98C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CallObject_Traceback_
                                                                              • String ID: D:\a\1\s\Modules\pyexpat.c
                                                                              • API String ID: 1142842016-3460214922
                                                                              • Opcode ID: 92ad9d6fa8c185cfce829b5c419b3f96376c9b3af91439abfd41e60d363adc12
                                                                              • Instruction ID: 6328433d796d4b446ce15af6d672cad07ec46e8fc2f72939820df7a5f7b01e16
                                                                              • Opcode Fuzzy Hash: 92ad9d6fa8c185cfce829b5c419b3f96376c9b3af91439abfd41e60d363adc12
                                                                              • Instruction Fuzzy Hash: BA01A766B08F4282EF688B57E84427A63A9FB48FE0F589575DE4D07B68DE3CD5418700
                                                                              Function 00007FF7BD3CF09C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736450646.00007FF7BD3B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BD3B0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736425005.00007FF7BD3B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736482273.00007FF7BD3DA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3ED000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736509681.00007FF7BD3FC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736581353.00007FF7BD3FE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ff7bd3b0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                              • String ID: :
                                                                              • API String ID: 2595371189-336475711
                                                                              • Opcode ID: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                                                              • Instruction ID: d60ea243c01b6f0165575908ce6eea43b20058adc4d7d487a53a972b5e6e5cd9
                                                                              • Opcode Fuzzy Hash: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                                                              • Instruction Fuzzy Hash: 9A01B12291D312C6F768BB28946127EE3A0EF66704FC8103DD74C4729BFE2DE5448B24
                                                                              Function 00007FFDFB1A15AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _time64
                                                                              • String ID: !$..\s\crypto\ct\ct_policy.c
                                                                              • API String ID: 1670930206-3401457818
                                                                              • Opcode ID: f18ed828a28c6ab51aa7041c4afaf51f6b8b90cc747c6e012aca78e72ff6fbca
                                                                              • Instruction ID: 5a4c5aa4df6e3d5d33bc067c845eda86f75e15dd43652731777d39263266e089
                                                                              • Opcode Fuzzy Hash: f18ed828a28c6ab51aa7041c4afaf51f6b8b90cc747c6e012aca78e72ff6fbca
                                                                              • Instruction Fuzzy Hash: 2BF0CD32F1760B86EB119B20D421BEE2354EF40308F540434DA2E067EAEE3CF655DB40
                                                                              Function 00007FFE11EC9F2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_Object_StringTrue
                                                                              • String ID: Cannot delete attribute
                                                                              • API String ID: 1323943456-1790985853
                                                                              • Opcode ID: a9b9417798d186abded7274f866e88ba46e5fd2a0e6bd8a384be0658d3fbe29e
                                                                              • Instruction ID: 5b65bc1e586fe9d3c79ba7aa9089e09d1788cd2d366d9a28dc13bd35ad2db3b6
                                                                              • Opcode Fuzzy Hash: a9b9417798d186abded7274f866e88ba46e5fd2a0e6bd8a384be0658d3fbe29e
                                                                              • Instruction Fuzzy Hash: 6EF09665B09F4382FF158BBB8C5423622A9AF85B74F545271DD2D862B4EE2CE4818304
                                                                              Function 00007FFE11EC9FF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE11ECC8CC: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8D2
                                                                                • Part of subcall function 00007FFE11ECC8CC: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8E0
                                                                                • Part of subcall function 00007FFE11ECC8CC: strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC8FC
                                                                                • Part of subcall function 00007FFE11ECC8CC: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE11ECA00B), ref: 00007FFE11ECC904
                                                                              • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11ECA015
                                                                                • Part of subcall function 00007FFE11ECC53C: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11ECC572
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: _errno$__acrt_iob_func__stdio_common_vfprintfgetenvstrtoul
                                                                              • String ID: EXPAT_ENTROPY_DEBUG$expat: Entropy: %s --> 0x%0*lx (%lu bytes)
                                                                              • API String ID: 1947085748-401753140
                                                                              • Opcode ID: 3c21e4b76e0c7f3b008b0b68308483547d3def289599a0f61e0cadeabc434970
                                                                              • Instruction ID: 7e4a9f00f7a1d624661bc6d307a267b47b4d51e03597aefb0eaa55e15d87c5a1
                                                                              • Opcode Fuzzy Hash: 3c21e4b76e0c7f3b008b0b68308483547d3def289599a0f61e0cadeabc434970
                                                                              • Instruction Fuzzy Hash: FAF0A026B08A4282EB005B96FC8427AA764BB887E4F844079DA4D477B6CE2CE5458B04
                                                                              Function 00007FFE1A45EE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                                • Part of subcall function 00007FFE1A45F050: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A45F110
                                                                                • Part of subcall function 00007FFE1A45F050: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A45EE15), ref: 00007FFE1A45F15F
                                                                                • Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE
                                                                              • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45EE3A
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: CurrentImageNonwritableUnwindabortterminate
                                                                              • String ID: csm$f
                                                                              • API String ID: 4189928240-629598281
                                                                              • Opcode ID: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
                                                                              • Instruction ID: 439b4ab186a30d8487f58195f1504811de730e969a15e9b3a06dd8e9fb9fa11c
                                                                              • Opcode Fuzzy Hash: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
                                                                              • Instruction Fuzzy Hash: 99E065F1E18B4281EB607B63B58517D67A4AF05F74F1C80F6DA8807666CF3DD8B08641
                                                                              Function 00007FFE11EBE114 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_Object_StringTrue
                                                                              • String ID: Cannot delete attribute
                                                                              • API String ID: 1323943456-1790985853
                                                                              • Opcode ID: bd6ed47d6c8feddeade60c45839d130a54cff1d29265f0cbc8fe3103c7dac3b0
                                                                              • Instruction ID: 2f9e63d07b281e3b8daae7c189b5aea2e26673df8e5ba6b53c43cdb7742e41f0
                                                                              • Opcode Fuzzy Hash: bd6ed47d6c8feddeade60c45839d130a54cff1d29265f0cbc8fe3103c7dac3b0
                                                                              • Instruction Fuzzy Hash: CAE06D65B08E0381EF148BB39D8017622A9AF49BB5F6061B1CA2D8A2B0DE3CE0818304
                                                                              Function 00007FFDFB1A6BEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLastioctlsocket
                                                                              • String ID: ..\s\crypto\bio\b_sock.c
                                                                              • API String ID: 1021210092-540685895
                                                                              • Opcode ID: 4d68a102142dda0a141e0aa41e49ba71bac8bdbe77c0eb6d10dc70971b8a66ca
                                                                              • Instruction ID: 73991d00a0cfa02ed4e3732baeababfc1b26bb7d67bf13b27c0f0ddd25344bc5
                                                                              • Opcode Fuzzy Hash: 4d68a102142dda0a141e0aa41e49ba71bac8bdbe77c0eb6d10dc70971b8a66ca
                                                                              • Instruction Fuzzy Hash: F3E01A61F1A5138AF7126B60A834FB92354AF05709F004534E92D866F9EE2DB6598A50
                                                                              Function 00007FFE11EC9FAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Strings
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740121186.00007FFE11EB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EB0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740092134.00007FFE11EB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740156853.00007FFE11ED2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740200829.00007FFE11EDB000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1740250340.00007FFE11EDE000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe11eb0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: Err_Object_StringTrue
                                                                              • String ID: Cannot delete attribute
                                                                              • API String ID: 1323943456-1790985853
                                                                              • Opcode ID: bc7705b4852f145fe3769901dd8926da39069cb191b86ca93b042b14d9c8c169
                                                                              • Instruction ID: 1fb15faaa9e8d348a7cb7e6e2381ac02af08fbfb87c4d5b87d49d0342fe2c881
                                                                              • Opcode Fuzzy Hash: bc7705b4852f145fe3769901dd8926da39069cb191b86ca93b042b14d9c8c169
                                                                              • Instruction Fuzzy Hash: 5AE01265F14D4781EF188BB79C4027A22A9AF54BB4B5091B1D92D4A2B0EE2CE1958701
                                                                              Function 00007FFDFB3DB690 Relevance: 5.2, APIs: 4, Instructions: 239COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • memchr.VCRUNTIME140(00007FFDFB3DB5FB,00000000,?,00000000,00007FFDFB3DA899), ref: 00007FFDFB3DB7CB
                                                                              • memchr.VCRUNTIME140(00007FFDFB3DB5FB,00000000,?,00000000,00007FFDFB3DA899), ref: 00007FFDFB3DB813
                                                                              • memchr.VCRUNTIME140(00007FFDFB3DB5FB,00000000,?,00000000,00007FFDFB3DA899), ref: 00007FFDFB3DB82D
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memchr
                                                                              • String ID:
                                                                              • API String ID: 3297308162-0
                                                                              • Opcode ID: c5053ac5122ae20ce2bba16029e3ae9fdfc9990fab1c8ee538e04b1850252035
                                                                              • Instruction ID: 2e2e89d2978da15bc8a08575c1d31362be77648bf2039a66e06a7ba8ddf69315
                                                                              • Opcode Fuzzy Hash: c5053ac5122ae20ce2bba16029e3ae9fdfc9990fab1c8ee538e04b1850252035
                                                                              • Instruction Fuzzy Hash: B391C66AF496CA83EB10AB16D4A0539A7E0FB8DBC4F584035DF5C837A9DE2EE445C701
                                                                              Function 00007FFE1A4569DC Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                              Download Yara Rule
                                                                              APIs
                                                                              • GetLastError.KERNEL32(?,?,?,00007FFE1A456859,?,?,?,?,00007FFE1A45FF42,?,?,?,?,?), ref: 00007FFE1A4569FB
                                                                              • SetLastError.KERNEL32(?,?,?,00007FFE1A456859,?,?,?,?,00007FFE1A45FF42,?,?,?,?,?), ref: 00007FFE1A456A84
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1740949605.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true
                                                                              • Associated: 00000002.00000002.1740857247.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741019337.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741049295.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1741078012.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffe1a450000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: ErrorLast
                                                                              • String ID:
                                                                              • API String ID: 1452528299-0
                                                                              • Opcode ID: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
                                                                              • Instruction ID: c537d69b825f7dc53fcf8138677aa6a089e144648b5cfd350e592b649c7ac000
                                                                              • Opcode Fuzzy Hash: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
                                                                              • Instruction Fuzzy Hash: 46112160F0DA4242FA14AB27B844134B2A16F49FF4F1C86F6D96E077F5DF2CE8619640
                                                                              Function 00007FFDFB1A53E9 Relevance: 5.0, APIs: 4, Instructions: 48COMMON
                                                                              Download Yara Rule
                                                                              APIs
                                                                              Memory Dump Source
                                                                              • Source File: 00000002.00000002.1736635525.00007FFDFB1A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB1A0000, based on PE: true
                                                                              • Associated: 00000002.00000002.1736611386.00007FFDFB1A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB1AD000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB205000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB219000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB229000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB23D000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736635525.00007FFDFB3ED000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB3EF000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB41A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB44C000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1736965522.00007FFDFB471000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737115322.00007FFDFB4BF000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737139761.00007FFDFB4C0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4C7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E4000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              • Associated: 00000002.00000002.1737166133.00007FFDFB4E8000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                              Joe Sandbox IDA Plugin
                                                                              • Snapshot File: hcaresult_2_2_7ffdfb1a0000_PDF_Resave.jbxd
                                                                              Similarity
                                                                              • API ID: memmove
                                                                              • String ID:
                                                                              • API String ID: 2162964266-0
                                                                              • Opcode ID: c7954e11c4b5c180aee147f19bd23452bbd2d047806da0b6489b870047a3b121
                                                                              • Instruction ID: c7838f6c02d5b39d5256ac95594c23dc47f74f2f856e24ea6a957377a5b2023f
                                                                              • Opcode Fuzzy Hash: c7954e11c4b5c180aee147f19bd23452bbd2d047806da0b6489b870047a3b121
                                                                              • Instruction Fuzzy Hash: 3411D062B0564286D710EB1AE4501ED7360FB447D4F448132EB6E87BEAEF28E6A4C700